_ «Approved For Release 2006/02/40.: CiA-RDP96B01172R000100090004-9 


a 


A REPORT 10 OTF ie 
SECRETARY OF DEFENSE 
BY THE COMMISSION TO 

REVIEW DOD SECURITY 
POLICIES AND or ICeS 


No Referral - On file OSD releas¢ 
instructions apply. 


Tira ee ie 


— 


Siig he 


Table of Contents 


Letter of Transmittal vi 


Members of the DoD Security 
Review Commission viii 


Introduction 1 


Executive Summary 5 


Overview 17 


Policy and Procedures 25 


Gaining and Maintaining Access 
To Classified Information 25 


Requests For Security Clearance 27 


Eligibility For Security Clearances 30 


Initial Investigations 31 


Adjudication 34 


Periodic Reinvestigations 37 


Use of the Polygraph As A 
Condition Of Continuing Access 38 


Establishing Special Controls Governing Access 
To Cryptographic Materials 41 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


Continuing Command/Supervisory Evaluations 42 


Acquiring Information From Additional Sources 45 


“Managing And Controlling Classified 


Information 47 


Classification 48 


Dissemination Of Classified Information 51 


Transmission Of Classified Information 54 


Retention and Storage 57 


Special Access Programs 58 


International Cooperation Involving 
The Transfer Of Classified Information 61 


Detecting And Countering Hostile Intelligence 
Activities Against DoD 64 


Limiting And Controlling The Hostile Presence 
Within The United States 65 


Identifying And Monitoring Hostile 
Intelligence Agents 67 


Counterintelligence Operations 
And Analysis 68 


Security Awareness Programs 69 


Reporting Indications Of Possible Espionage 70 


Detecting And Investigating 
Security Violations 72 


Taking Effective Action Against 
Those Who Violate The Rules 73 


- Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


erence 2” seme 


Management And Execution 79 


Commander/Supervisor Emphasis 79 


Organizational Arrangements 81 
Research 86 
Training 88 


Career Development 90 


Program Oversight 91 


Resource Management 92 


Resource Impact 95 


Conclusion 99 
Appendices 102 


Appendix A: Persons Who Testified 
Before The Commission 103 


Appendix B: Senior Industry 
Officials Interviewed By The Commission 107 


Appendix C: Senior Industry 
Officials Who Provided Written 
Comments To The Commission 109 


Appendix D: Deputy Secretary of Defense Letter of 
August 28, 1985 (Subject: Security Evaluation of DoD 
Personnel With Access To Classified Information) 112 


Appendix E: Secretary of Defense Letter of June 25, 
1985 (Subject: Commission to Review and Evaluate 
DoD Security Policies and Procedures) 114 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-8 


Letter of 
Transmittal 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


OFFICE OF THE SECRETARY OF DEFENSE 


WASHINGTON, D.C. 20301 


DoD Security 19 November 1985 
Review Commission 


The Honorable Caspar W. Weinberger 
Secretary of Defense 
Washington, D. C. 20301 


Dear Mr. Secretary: 


On June 25, you established the DoD Security Review Commission. 
Pursuant to its charter, the Commission has examined relevant 
DoD policies and procedures; reviewed recent security incidents 
and pertinent studies and reports; conducted numerous interviews 
of cognizant officials, within and outside the Executive Branch, 
as well as of knowledgeable individuals from the private sector; 
solicited written views from an even wider community; examined 
several security systems and organizational arrangements; 
identified key vulnerabilities and deficiencies; and devised 
remedies which are consistent with accomplishment of the 
Department's overall mission, protection of individual rights 
and fiscal constraints. 


I have the honor of transmitting herewith the Report of the 
Commission. My distinguished colleagues have asked me to 
underscore that this document, including its sixty-three 
recommendations, are unanimously agreed. 


We, the Commissioners, are persuaded that implementation of 
our recommendations would result in significantly improved 
security for classified information by enhancing deterrence 
and providing greater likelihood of detecting potential or 
actual compromise at an earlier stage. Loss of our secrets 
whether through espionage, theft or unauthorized disclosure 
for other reason - will never be eliminated, but the oppor- 
tunities therefor can be diminished and attempts at compromise 
made more difficult at acceptable - indeed modest - cost. 


Sincerely, 


Attachment Chairman 
Report of the Commission 


No Referral - On file OSD release instructions apply. 
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Introduction 


On June 25, 1985, Secretary of Defense Caspar 
W. Weinberger established the Department of Defense 
Security Review Commission in the wake of the arrests of 
three retired and one active duty Navy member on 
charges of espionage. The Commission was directed to 
“conduct a review and evaluation of DoD security policies 
and procedures” and “identify any systematic 
vulnerabilities or weaknesses in DoD security programs, 
including an analysis of lessons learned from incidents 
which have occurred recently, and make recommenda- 
tions for change, as appropriate.” Appendix E contains 

' the Commission’s charter and terms of reference. 

The Commission began its work by reviewing ex- 
tant policy, programs, and procedures in the security 
area. It also reviewed the recommendations of other 
bodies which have recently urged changes to DoD securi- 
ty policies and procedures, notably the Subcommittee on 
Permanent Investigations of the Senate Government Af- 
fairs Committee and the DoD Industrial Security Review 
Committee (the “Harper Committee”). ‘The Commission 
specifically addressed each of the problems raised by the 
reports of both bodies where DoD itself had not already 
taken action on their recommendations. Previous DoD 
reports in this area were also reviewed and analyzed, as 
were a number of audit, inspection, and survey reports of 
various DoD components. 
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The Commission also solicited recommendations 
for improvement from DoD components, other depart- 
ments and agencies in the Executive Branch, congres- 
sional staffs, defense contractors, and private citizens and 
organizations. Testimony before the Commission was 
presented by 34 witnesses (see Appendix A for identifica- 
tion). In all, more than 1,000 recommendations were 
received and considered. 


The Commission held 17 separate formal sessions 
commencing on June 26, 1985 and lasting through 
November 6, 1985. In addition to these formal sessions, 
Commission members conducted separate interviews 
with selected corporate officials whose companies held 
classified defense contracts and received written views 
from 24 others, in order to obtain greater industry par- 
ticipation. (See Appendicies B and C for identification.) 
Informal discussions were also held with a number of 
other individuals who held views on the conduct of DoD’s 
security programs. 

The Commission was briefed in detail regarding 
past and pending espionage prosecutions, and many of 
the Commission’s recommendations are directed at 
vulnerabilities apparent from the misconduct proved or 
alleged in these cases. However, inasmuch as the Com- 
mission wished to avoid any action that could jeopardize 
any pending prosecution, this report does not refer to 
them, or to actions alleged to have been committed by 
any defendant, as the basis for specific recommendatons. 

The Commission’s report focuses upon the protec- 
tion of classified information. While fully aware of the im- 
portance of protecting unclassified but sensitive informa- 
tion—a monumental “security” problem in its own 
right — the Commission did not interpret its charter as re- 
quiring an analysis in this area. However, it urges more 
expeditious implementation of the authority given the 
Secretary of Defense to withhold from public disclosure 
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unclassified technical data which is subject to export con- 
trols. 

The Commission’s recommendations relate pri- 
marily to countering the aman intelligence threat as 
contrasted with the threat posed by collection through 
technical means. Although fully aware of the vulnerabili- 
ty of communications networks and automated informa- 
tion systems to compromise by technical means, the 
Commission did not assess the current capability to pre- 
vent such collections. The Commission took note that 
inter-agency mechanisms have recently been established 
at national level to develop effective technical solutions in 
this very complex and increasingly important area. For its 
part, the Commission endorses the need for accelerated 
research to support this effort. 

The report does not address, and, unless specifi- 
cally stated, does not affect policies and procedures for the 
protection of Sensitive Compartmented Information 
(SCI), which are under the purview of the Director of 
Central Intelligence (DCI). 

The report provides only a general description of 
DoD security programs because it would require volumes 
to detail the myriad of policy and procedure in this broad 
and complex area. However, the report does treat the ma- 
jor policies and procedures and attempts to identify short- 
comings and vulnerabilities that are amenable to practical 
solution. Those solutions are set forth in the report, but 
without analysis of the competing alternatives within the 
text. 

This is not to say that other alternatives were not 
considered; they were. Based upon the evidence before it, 
the Commission arrived at a unanimous position with 
respect to those recommendations which would be effec- 
tive, given the nature of the problem, and those which 
would be feasible, given existing law, policy, and opera- 
tional impact. 
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Executive Summary 


Each year thousands of classified programs and 
projects are carried out by the Department of Defense, 
through its components and its contractual base, in a 
wide variety of operational and geographical settings. 
These activities generate millions of items of classified in- 
formation, ultimately disseminated to almost four million 
individuals who require such information to perform their 
assigned tasks. This classified information is not only in 
the form of documents. An enormous inventory of 
classified equipment, both end items and components, 
must be safeguarded; and, increasingly, classified data is 
being processed, transmitted and stored electronically, 
posing serious new problems of protection. 

Arrayed against this vast and immensely impor- 
tant target are the intelligence services of the Soviet 
Union, its surrogates and other countries with interests 
hostile to the United States and its allies. In combination, 
those services conduct massive and highly organized col- 
lection operations to acquire all information, classified 
and unclassified, of military value. Although a variety of 
means, both human and technical, are employed, human 
collection constitutes the more significant threat within 
the continental United States today. 

Protecting a nation’s defense secrets from com- 
promise is an age-old challenge. However, the stakes for 
the United States have never been higher. Given the 
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extraordinary importance of advanced technology to our 
nation’s military capabilities, its loss to a potential adver- 
sary—by espionage, theft or other unauthorized 
disclosure—can be crucial to the military balance. So, 
too, can comprise of operational plans or battle tactics. 
Thus to the extent that classified information can be kept 
from the hands of those who may oppose us, the 
qualitative edge of United States military forces is 
preserved and their combat effectiveness assured. 

The Department of Defense has countered the, 
threat posed by hostile intelligence services by 
establishing a comprehensive set of policies and pro- 
cedures designed to prevent unauthorized persons from 
gaining access to classified information. Some of these 
policies implement national directives; others were pro- 
mulgated by the authority of the Secretary of Defense. 

The need to protect classified information is taken 
as an absolute imperative in principle. In reality, how- 
ever, policies fashioned to protect classified information 
are tempered by budgetary constraints, operational 
necessities and the basic rights of individuals. Moreover, 
some security practices continue in effect even though 
demonstrably unproductive. 

Policymaking in the security area is centralized, 
but implementation is properly left to DoD components 
who provide instructions to thousands of commanders 
and supervisors around the world. In the final analysis, 
safeguarding classified information comes down to proper 
supervision and the individual’s responsibility to apply 
the rules. 
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General Assessment 


In general, the DoD security program has been reason- 
ably effective. When considering the potential for com- 
promise, known DoD losses have been relatively few. 
Some losses, however, have proved gravely damaging. 
While no system of security can provide foolproof protec- 
tion, it can make espionage more difficult to undertake 
and more difficult to accomplish without detection; and it 
should miminize the compromise of classified information 
whatever the cause. In these respects, DoD’s current pro- 
gram falls short of providing as much assurance as it 
might. 

The reason, in part, is technical. There are insuffi- 
cient technical means available to securely process, trans- 
mit and store classified information in electronic form. 
But important as this might be, the far greater challenge 
is people—those who create and handle classified infor- 
mation, those who disseminate it, and those who oversee 
its protection. While the overwhelmingly majority carry 
out such functions responsibly, there are some who fail to 
do so. And the current security system falls short in 
limiting the opportunities for errors of omission or com- 
mission; in providing the means to identify those who 
transgress; and in dealing appropriately with the trans- 
gressors. 

This, then, was the focus of the Commission’s in- 
quiry: how can the DoD security system be improved to 
ensure that only trustworthy persons are permitted within 
it; that they abide by the rules; that those who choose to 
violate the rules are detected; and those who are detected 
are dealt with justly but firmly. 
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Key Findings and 
Recommendations 


The report contains numerous recommendations to im- 
prove the security of classified information within DoD. 
Highlighted below are the Commission’s key findings and 
summaries of major recommendations. 


e FINDING: Requests for security clearance must be reduced 
and controlled. DoD components and contractors request 
security clearances for many individuals who do not 
need continuing access to classified information. Un- 
justifiable requests overburden the investigative pro- 
cess and pose an unneeded security vulnerability. 
Although some reductions have already been achieved, 
better means of control are esssential. 


RECOMMENDATIONS: 


—Create a TOP SECRET billet control 
system, similar to that in use for Sensitive Compart- 
mented Information (SCI) access, to ensure that TOP 
SECRET clearances go with a position, rather than an 
individual. 

—Require contractors to provide specific 
justification for requests for security clearances; pro- 
hibit requests solely for movement within a controlled 
area whenever exposure to classified information can 
be prevented. 

— Authorize, subject to strict control, one-time, 
short-duration access to specific information at the 
next higher level of classification to meet operational 
exigencies. 
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e FINDING: The quality and frequency of background in- 
vestigations must be improved. The investigative basis for 
award of a SECRET clearance is a personal history 
statement and a National Agency Check which provide 
extremely limited knowledge of the subject. DoD con- 
ducts background investigations for TOP SECRET 
clearances. It conducts five-year reinvestigations only 
for TOP SECRET clearances and SCI accesses, and is 
far behind schedule in meeting this requirement. 


RECOMMENDATIONS: 


— Expansion of the investigative scope for a 
SECRET clearance to include a credit check of the 
subject and written inquiries to past and present 
employer(s). 

— Intensification of behavioral science research 
to the end of improving the background investigative 
process and the effectiveness of subject interviews. 

— Reduction of the backlog of reinvestigations 
for TOP SECRET and SCI accesses to manageable 
levels within four years and development of a plan for 
accomplishing periodic reinvestigations of all persons 
holding SECRET clearances and above by 1995. 


FINDING: The Department’s most sensitive information 
must be accorded higher priority in attention and resources. 
Although the counterintelligence-scope polygraph ex- 
amination is the one investigative tool which might 
have prevented — or earlier detected — recent acts of es- 
pionage, its use in the Department is severely 
restricted, in time and scope, by the Congress. There 
are no special eligibility criteria for personnel handling 
cryptographic materials despite their transcendent im- 
portance to an adversary. Only those individuals who 
have access to nuclear weapons are currently 
monitored formally for trustworthiness and stability. 
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to provide extraordinary security protection; in fact, 
some do not. 


o RECOMMENDATIONS: 


— Request the Congress to supplant the year- 
by-year approach to the conduct of counterin- 
telligence-scope polygraph examinations by giving 
authority for the Secretary to develop a coherent and 
gradually expanding program, with stringent quality 
controls and subject to congressional oversight. 


—Institute a “crypto-access” program for all 
persons who have continuing access to cryptographic 
information in large quantities or with highly sensitive 
applications. 

— Direct appropriate DoD components to in- 
stitute a reliability program (modeled on, but less 
structured than, the DoD Personnel Reliability Pro- 
gram) for military and civilian personnel involved in 
especially sensitive programs or assigned to TOP 
SECRET positions of high criticality. 

— Direct a review and revalidation of Special 
Access Programs, promulgation of uniform minimum 
security standards and the regularization of inspection 
and oversight of such programs. 


FINDING: The adjudication process in which security 
clearance determinations are rendered must be improved. ‘There 
is reason for concern about the efficacy of the adjudica- 
tion process. The denial rate is low throughout the | 
DoD but nonetheless varies widely among the military 
departments and defense industry. Although adjudica- 
tion is the final step in determining eligibility for access 
to classified information, such decisions are made on 
the basis of vague criteria, and many adjudicators are 
inadequately trained. As a result, it is possible to reach 
different adjudicative determinations in applying the 
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o RECOMMENDATIONS: 


—Necessary research and other actions be 
undertaken to develop more precise and effective ad- 
judicative standards. 

—Development and conduct of standardized 
mandatory training for all adjudicators. 


FINDING: Classified information must be better controlled. 
There are no uniform controls over SECRET informa- 
tion, or any requirement, apart from records disposi- 
tion schedules, for unneeded classified documents to be 
periodically destroyed. There is no overall policy 
governing access to areas containing sensitive informa- 
tion or search of persons entering or leaving DoD in- 
stallations. 


RECOMMENDATIONS: 


—Institute a uniform degree of accountability 
for SECRET documents within DoD. 


— Prohibit the retention of classified documents 
which are not “permanently valuable records of the 
government” more than five years from the date of 
origin, unless specifically authorized in accordance 
with record disposition schedules established by the 
component head. 

— Establish a general policy, subject to waivers 
prescribed by component heads, that employees not be 
permitted to work alone in areas where TOP SECRET 
or Special Access Program materials are in use or 
stored. 

—Establish a policy that all briefcases and 
similar personal belongings are subject to search upon 
entry and exit from DoD installations to determine if 
classified information is being removed without 
authority. 
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¢ FINDING: Further initiatives are needed to counter the effec- 
tiveness of hostile intelligence activities directed at DoD. 
Although recent congressional and Executive Branch 
actions are important, more should be done to limit the 
size of the hostile intelligence presence within the 
United States and to constrain its freedom of action. 
Counterintelligence capabilities should be strengthen- 
ed and greater efforts made to detect contacts with 
hostile intelligence services. Security awareness ac- 
tivities need to be substantially increased and their 
quality improved. 


RECOMMENDATIONS: 


— Urge expansion of the national policy of pari- 
ty in numbers in the diplomatic establishments of the 
United States and Soviet Union, to include parity in 
treatment and privileges; extension of this concept to 
all nations which present a hostile intelligence threat to 
the United States; and imposition of travel restrictions 
on non-Soviet Warsaw Pact diplomats accredited to 
the United Nations. 

—In coordination with the DCI, ensure in- 
creased funding for counterintelligence analysis. 

—Require all cleared personnel to report 
foreign travel as well as contacts with foreign represen- 
tatives who request defense information. 

— Direct DIS, in conjunction with the FBI and 
military departments, to undertake immediate efforts 
to increase the size, effectiveness, and coordination of 
the security awareness program in industry. 


FINDING: The professionalism of security personnel must be 
enhanced. DoD does not prescribe minimal levels of 
training for security personnel. In general, training is 
narrow in scope and coverage, is not mandatory and 
does not lead to official certification. Some individuals 


12 Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


performing security duties do not adequately under- 
stand overall security concepts. 


RECOMMENDATIONS: 


— Establish training standards, direct develop- 
ment of basic courses of instruction for the several 
security disciplines and prescribe requirements for cer- 
tification. 


FINDING: Substantially increased basic research is needed to 
guide security policy and practice. The Commission’s work 
was hampered by the lack of firm data and meaningful 
analysis in several aspects of the security equation. 
There is minimal ongoing research although the poten- 
tial dividends from a purposeful effort into a wide 
range of security-related matters are high. 


RECOMMENDATIONS: 


~— Direct expansion of the Defense Security In- 
stitute and task it, inter alia, with overall coordination 
of significantly increased research and development in 
essential security-related areas, notably including the 
personnel investigative process and physical security 
technology. 


—Provide increased funding of the National 
Computer Security Center’s research and development 
program. 


FINDING: More effective action should be taken against those 
who violate security rules. While sanctions available to 
remedy security violations by uniformed military per- 
sonnel appear adequate, remedies with respect to 
civilians and contractors are not. Moreover, those 
remedies which are available could be better utilized. 
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© RECOMMENDATIONS: 


—Continue to advocate enactment of legisla- 
tion to enhance criminal enforcement remedies against 
civilian employees and contractors who disclose 
classified information without authority. 

— Utilize existing legal remedies to withhold 
payments under DoD contracts to obtain contractor 
compliance with DoD security requirements. 

— Revoke the DoD facility clearance of contrac- 
tors who display management indifference to security 
through repeated security violations or in other ways, 
even though security deficiencies are remedied. 


FINDING: The state of DoD security is critically dependent 
upon the actions of commanders and supervisors at all levels. 
Security is everybody’s business and, most notably, 
that of the individual in charge. As with all other 
responsibilities vested in them, it is incumbent upon 
commanders and supervisors to underscore the impor- . 
tance of the security function by personal example, by 
setting forth the rules, by inspecting for compliance 
and by disciplining those who fall short. Throughout 
DoD, discharge of this responsibility is uneven. Insuf- 
ficient attention has been given to the overall purpose © 
of security as it relates to organizational mission, to 
observation of subordinates’ security performance and 
insuring that basic security principles are adhered to in 
practice. The key to genuine improvement in DoD’s 
security posture is continuing, pervasive oversight by 
commanders and supervisors at all levels. 


RECOMMENDATIONS: 


—Direct all DoD components which handle 
and store classified information to institute a one-time 
“top-to-bottom” command inspection at every level of 
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compliance with applicable security policies. Recur- 
ring inspections performed thereafter should also in- 
clude examination of compliance with these security 
requirements. 

—Instruct commanders/supervisors to utilize 
all appropriate enforcement remedies against security 
violators. 


Resource Impact 


While the resource impact of its recommendations 
cannot be determined with precision, the Commission 
estimates that the cost of implementing them would be 
relatively modest. If these recommendations are ap- 
proved, DoD components should be directed to begin ac- 
commodating these increased outlays within the normal 
program/budgeting process. 


Conclusion 


The Commission believes that increased priority 
must be accorded DoD security efforts to provide 
reasonable assurance that the nation’s secrets are pro- 
tected. More resources should be allocated to security, 
even at the expense of other DoD programs. New 
safeguards must be established and old ones improved, 
even at some cost to operational efficiency and conve- 
nience. This is not to say that some resources cannot be 
saved, or operational. efficiency improved, by eliminating 
burdensome and unproductive security requirements. In- 
deed, a number of such changes are recommended. But 
on the whole, a DoD must be willing to pay the price to 
protect its secrets. 

The Commission arrives at this conclusion mind- 
ful that security plays a supporting role in the successful 
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classified project or operation will be short-lived at best if, 
at the same time, the results have been revealed to poten- 
tial adversaries, who are then enabled to develop 
countermeasures at a more rapid pace than otherwise. As 
bureaucratic and mundane as security requirements 
sometimes appear, they offer the only systematic means 
available to protect and preserve the defense community’s 
triumphs and advances, over time. Security must be 
given its fair share of serious attention and its fair share of 
resources. 
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Overview 


The might of a nation is typically expressed in 
terms of its resources, including its military capability, 
wealth, natural resources, population, industrial capac- 
ity, agricultural production and geographic features. A 
nation’s knowledge (or information) is an important com- 
ponent of its might; the importance of knowledge to na- 
tional power has grown markedly since World War II 
because of the increased importance of sophisticated 
systems and processes in military operations, industrial 
and agricultural production, transportation and other 
major activities. The growth in importance of knowledge 
to national might has been accompanied by nations’ 
awareness that they can reduce the cost and time required 
to advance their own knowledge if they can obtain other 
nations’ information — with or without their concurrence. 

The United States has, as a matter of national 
priority, sought to expand its knowledge and_ has 
allocated huge sums of money to programs designed to in- 
crease its knowledge across a wide range of subjects and 
disciplines. As the leader of the free world, the United 
States has willingly shared its military and other informa- 
tion with allies and other nations that share common pur- 
poses. At the same time, the United States has sought to 
deny its hard-earned knowledge, including our nation’s 
secrets, from those who might use them against us in the 
future. Keenly aware of the role of knowledge and infor- 
mation to national might, the Commission gave great at- 
tention to DoD classified information, the hostile threat to 
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The Target 


The Department of Defense, together with its con- 
tractual base, constitutes a target of immense size and im- 
portance to the intelligence services of nations with in- 
terests inimical to the United States and its Allies. Given 
the major role of our Armed Forces as an instrument of 
U.S. foreign policy, DoD is involved in virtually every 
national security decision; and the myriad classified 
plans, programs, and actions that derive from those deci- 
sions reflect U.S. intentions and capabilities in peace, 
crises and war. With few exceptions, our fielded weapon 
systems are the world’s most effective; and our 
laboratories and test facilities have the requisite lead in 
most militarily-relevant areas of research and applied 
technology, assuring the qualitative advantage of future 
weapon systems. A huge intelligence organization sup- 
ports all these activities. 

It follows that most elements of the Department 
must deal with classified information. Thousands of 
classified programs and projects are carried out annually 
throughout the large and complex structures of the three 
Military Departments, the Office of the Secretary of © 
Defense, the Organization of the Joint Chiefs of Staff, the 
Unified and Specified Commands, and the Defense 
Agencies. The geographic distribution of classified infor- 
mation is also extensive. DoD maintains an official 
presence—some very large, as in Western Europe and 
Korea—in 95 countries. Additionally, vast quantities of 
classified documents, technical data, and equipments are 
released to Allied and friendly governments and to inter- 
national organizations under bilateral and multilateral ar- 
rangements. 

The volume of classified material produced, received, 
transmitted, and stored within DoD is staggering. DoD 
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in 1984. The number of classified documents actually 
maintained in DoD filing systems and those of its contrac- 
tors is unknown; however, an estimate of 100 million is 
not unrealistic. 

But size alone does not begin to convey the dimen- 
sions of the task of protecting classified information. 
DoD, for example, maintains enormous inventories of 
classified end items and components, which require dif- 
ferent protection than documents. Similarly, the DoD is 
moving at a bewildering rate from controlling 
“hard-copy” documents to controlling classified informa- 
tion electronically stored and transmitted by automated 
data processing systems. Within DoD, there are an 
estimated 16,000 computers, most of which process infor- 
mation of value to an adversary, and many of which are 
internetted. And not only government facilities are in- 
volved —classified work is presently progressing at over 
13,000 cleared defense industrial firms. 

Not surprising, 90 percent of the personnel in the 
Executive Branch who have security clearances are in 
DoD. 2.6 million uniformed and civilian personnel hold 
some form of clearance (after the 10 percent reduction 
mandated in June 1985 by the Secretary of Defense). 
These are augmented by 1.2 million cleared industrial 
employees. (DoD, incidentially, administers industrial 
security not only for itself but for 18 other Executive 
departments and agencies.) A substantial number of these 
cleared personnel — military, civilian and contractor—are 
located outside the continental United States. 

In short, the challenge of protecting United States 
defense secrets is of almost immeasurable scope. 


The Threat 


The Soviet Union, its Warsaw Pact and Cuban 
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the United States, have conducted and will continue to 
conduct massive and highly organized intelligence gather- 
ing operations against DoD personnel, installations, and 
contractors. Such operations utilize both human and 
technical collectors targeted against classified and 
unclassified information of military value. 

Unclassified information available to the public is 
systematically exploited by the intelligence services of 
these countries, and, by authoritative accounts, com- 
prises the bulk of information being collected. 
Unclassified information which is not available to the 
public generally, but which is militarily significant, is also 
sought through a wide variety of sources. For example, 
information which is transmitted electronically through 
the air can be presumed to be within the reach of hostile 
intelligence. Similarly, it can be presumed that hostile in- 
telligence will exploit every chance to acquire information 
of military value through industrial sources; through at- 
tendance at scientific and technical conferences; or 
through purchase, direct or via intermediaries. 

Classified miltiary information presents a more 
lucrative, if more difficult, target. Since such information 
is not, in theory, made public or transmitted over means 
which permit exploitation, the avenue to it is usually 
through persons who have, or may attempt to gain, 
authorized access. Indeed, there are hundreds of contacts 
with suspected intelligence agents reported by DoD per- 
sonnel and contractors every year, evidence of an active 
and continuing effort at recruitment. Unfortunately, 
there are numerous examples where DoD employees and 
contractors have volunteered their services, offering to 
sell classified information to which they have access. 
While evidence suggests that such disaffections are rare 
when compared to the size of the defense community, one 
person with sufficient access to classified information may 
be in a position to do incalculable harm to the national 
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It also merits underscoring that the same level of 
damage to the national security can be caused by persons 
who are not in the employ of a foreign power. The 
transmittal of classified information to unauthorized per- 
sons—whether by indiscretion or wittingly—places it 
beyond government controls. One must therefore assume 
that it may ultimately appear in the data bank of a hostile 
intelligence service. 

None of this is new; indeed, espionage is as old as 
the relationship between nations, and unauthorized 
disclosures of defense secrets have plagued governments 
for centuries. The stakes today, however, are much 
higher than ever before. Given the extraordinary impor- 
tance of sophisticated technology to our nation’s military 
capabilities, its loss to a potential adversary—by es- 
pionage, theft or unauthorized disclosure—can have a 
substantial and long-term bearing upon the military 
balance of power. Similarly, the loss of operational plans 
or tactics can provide an adversary with precisely the edge 
needed to defeat United States forces in combat. To the 
extent, therefore, that classified information can be kept 
from the hands of those who may oppose us, the effec- 
tiveness of United States military forces is preserved and 
extended for longer periods at lower costs to the defense 
effort. 


The DoD Response: 
In Retrospect 


Responding to the hostile intelligence threat over 

the years, DoD has established for its components and 

contractors a comprehensive set of policies and pro- 

cedures to prevent access to classified information by 

unauthorized persons. Some of these policies and pro- 

cedures implement law and national policy; many DoD 
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promulgates on its own authority. In either case, 
however, DoD typically has determined how classified in- 
formation will be protected against specific vulnerabilties 
by adjusting policy and procedure to the resources 
available, or which can reasonably be obtained, and to 
the probable impact of such policies and procedures on 
mission accomplishment. Thus, even though the protec- 
tion of classified information is, in general, taken as an 
absolute imperative, how this is accomplished often gives 
way to practical considerations of budget constraints and 
operational necessity. Moreover, even after policies and 
procedures are agreed to, these same considerations affect 
the level of implementation. Policies and procedures 
which are not adequately funded fall short of their objec- 
tive; those which are perceived as interfering unduly with 
mission accomplishment are often not enforced. 

Inadequately implemented policy and procedure 
does not constitute, however, the entire problem. Some 
policy and procedure continue to be implemented after 
they have proved to be ineffective, and, on balance, a 
waste of resources. Elimination or adjustment of long- 
time practice, despite demonstrated reason therefor, has 
proven difficult for security policymakers. 

While policymaking is centralized at OSD level, 
implementation is properly left to DoD components who 
provide instructions to thousands of commanders and 
supervisors at installations and facilities around the world 
in a variety of operational settings. Posters in the Pen- 
tagon proclaim that “Security is Everyone’s Business,” 
and certainly, in the final analysis, protecting classified 
information comes down to the responsibility of in- 
dividual employees to apply the rules and proper supervi- 
sion, 


Despite the complexity of policy and procedure 
and the vast population of cleared personnel governed by 
it, the DoD security program must be regarded as 
reasonably effective. Considering the potential for com- 
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relatively few. Some of these, however, have proved 
gravely damaging. Clearly there is room for improve- 
ment. Many people are cleared who do not need access to 
classified information. Background investigations yield 
relatively little derogatory information on those being 
cleared, and under the existing adjudication process, far 
fewer still are actually denied a clearance. Once cleared, 
very little reevaluation or reinvestigation actually occurs, 
and relatively few indications of security problems are 
surfaced. The principle that a cleared individual is 
authorized access only to that information he “needs-to- 
know’ is generally not enforced. For those contemplating 
espionage or intent on compromise of classified informa- 
tion for other reasons, the system does not provide suffi- 
cient deterrence. Moreoever, the volume of classified in- 
formation created and stored within DoD, and the less- 
than-stringent manner in which it is sometimes handled 


internally, often present opportunities to the would-be 
culprit that should not otherwise arise. Security regula- 
tions are often violated but only serious cases are typically 
made a matter of report; few of those are investigated, 
even where a pattern of such conduct is in evidence; and 
fewer still result in punishment. 
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Policy and Procedures 


DoD policy and procedures to protect classified in- 
formation are grouped into three categories: those that 
seek to insure that only trustworthy persons have limited 
and continuing access to classified material; those that 
regulate and control the information itself; and those that 
seek to cope with the hostile intelligence threat to the in- 
formation. The effectiveness of the Department’s 
classified information control system is largely a function 
of the success of these policies and procedures. 


Gaining and Maintaining 
Access to Classified 
Information 


Persons may gain access to classified information needed 
to perform official duties after receiving a security 
clearance. Requests for clearance originate with and are 
validated by the organizations to which individuals are 
assigned or the defense contractors with which employed. 
They are submitted together with a personal history state- 
ment filled out by the subject, to the Defense Investigative 
Service (DIS), which carries out appropriate background 
checks, based upon the level of clearance requested. Nor- 
mally only TOP SECRET clearances require field in- 
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generally require only a check of the records of relevant 
government agencies. The results of these investigations 
are returned, in the case of DoD personnel, to the re- 
questing component and, in the case of defense contrac- 
tors, to the Defense Industrial Security Clearance Office 
in Columbus, Ohio, for final processing. A decision to 
award a security clearance takes into account all the fac- 
tors involved in a particular case, and is made on the basis 
of an overall, common sense determination that access by 
the individual concerned is “clearly consistent with the na- 
tional security”, the standard for civilian employees set 
forth in Executive Order 10450 or, in the case of in- 
dustrial employees, Executive Order 10865. Once a 
clearance has been awarded, it remains valid until the re- 
quirement for access to classified information is ter- 
minated. However, receipt of adverse information re- 
garding an individual may lead to a “readjudication” of 
his or her clearance. Those who have TOP SECRET 
clearances or SCI access are required to be reinvestigated 
every five years although, due to lack of sufficient 
resources being allocated, DoD lags far behind in meeting 
the TOP SECRET requirement. 

The Commission notes that virtually all of the ex- 
tant federal policy with respect to gaining and maintain- 
ing access to classified information, including the revision 
of Executive Order 10450, is under review by an in- 
teragency working group, chartered under National 
Security Decision Directive 84, and chaired by the 
Department of Justice. Unfortunately, this project has 
been delayed for many months awaiting Administration 
approval of the working group’s proposed course of ac- 
tion. The Commission urges the Secretary to continue to 
press for National Security Council approval of this inter- 
agency group’s terms of reference for revamping federal 
policy in this crucial area. 
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Requests for Security Clearances 


There is no effective mechanism in place for adequately 
screening requests for security clearances to ensure that 
nominees actually need access to classified information. 
Components and contractors frequently request security 
clearances to provide additional assurance regarding the 
trustworthiness of their employees, even if they have no 
need for access to classified information. In many cases, 
persons are nominated for clearances because they were 
previously cleared and want to maintain such status. 
There is also a common practice of clearing those who 
may physically require access to a controlled area, 
regardless of whether such persons need access to 
classified information. Similarly, clearances are 
sometimes requested to avoid the requirement to escort 
uncleared persons in a classified area, even where such 
persons need not be exposed to classified information. 
Further, many contractors nominate employees for 
security clearances to establish and maintain a “stockpile” 
of cleared employees to be in a better competitive position 
to obtain classified work. 

These practices are very damaging in two 
respects. Where TOP SECRET clearances are con- 
cerned — which require substantial field investigation and 
reinvestigations— unjustified requests delay the clear- 
ances and reinvestigation of those who legitimately — and 
sometimes urgently — need access. Such delays necessari- 
ly result in lost time in a productive capacity both in DoD 
components and in industry. Moreover, overburdening 
field investigators erodes the quality of investigations. 

The recent action of the Secretary of Defense to 
direct an across-the-board 10 percent reduction in the 
number of existing clearances, and, concomitantly, his 
instruction to reduce by 10 percent the number of new 
clearance requests to be made in fiscal year 1986 should 
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ess. More permanent means of control are essential and 
feasible. 

The first is to adopt a system of billet control for 
TOP SECRET similar to that in effect for SCI accesses. 
Each component would identify those positions within its 
respective organization which required a TOP SECRET 
clearance. These would then be validated and maintained 
by appropriate authority. Only persons coming into such 
validated positions would be eligible for a TOP SECRET 
clearance. When they left such positions, the clearance 
would lapse. Provisions would be made to adjust the 
number of authorized positions based upon new classified 
functions or contracts, as validated by appropriate 
authority. 

The second is to remove from the security 
clearance process those individuals who require access to 
classified facilities but not to classified information; and to 
institute other procedures to assess their reliability. 

The third is to reaffirm the policy that the contin- 
uing need for access to classified information is the condi- 
tion precedent for requesting a security clearance while, 
concurrently, authorizing responsible officials to grant 
one-time access to the next higher level of classification to 
meet unforeseen contingencies. 


¢ RECOMMENDATIONS: 


oO 1. Establish a billet control system for TOP SECRET 
clearances both in DoD components and in industry. 

© 2. Prohibit the practice of requesting security 
clearances solely to: (i) permit access to a controlled 
area but where there is no exposure to classified infor- 
mation involved; or (ii) to permit ease of movement 
within classified areas, where the individual involved 
has no need for access to classified information and ac- 
cess realistically can be denied. However, allow heads 
of DoD components to request appropriate investiga- 
tions for determining reliability of individuals separate 
and distinct from the issuance of a security clearance. 
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clearances by specifying the reason(s) why the 
clearance is needed (e.g., contract number, RFP 
number, or other) rather than simply asserting such a 
need. Also, require contractors to rejustify every two 
years the security clearance of any employee who re- 
mains in an overseas assignment. Clearances which 
are not rejustified should expire. 

4. Modify the process whereby contractors obtain 
security clearances in order to bid on classified defense 
contracts by: 

a. Permitting firms which have held facility 
clearances within the past two years to be expeditiously 
reinstated provided they are still eligible. 

b. Permitting contractor employees who have 
held security clearances within the past five years to be 
reinstated administratively provided they have re- 
mained in the employ of their company, and no 
derogatory information concerning such employee is 
known to the company. However, in the case of a TOP 
SECRET clearance, a reinvestigation should be re- 
quired if the last investigation of such individual is 
more than five years old. 

c. Prescribe that contractors’ “stockpiling” of 
clearances for contingency purposes will henceforth 
constitute a major security deficiency when identified 
by DIS inspectors. 

5. Authorize one-time, short duration access by 
cleared personnel to the next higher level of classified 
information necessary to meet operational or contrac- 
tual exigencies. Within DoD components, such deter- 
minations must be at a level not lower than that of flag 
officer, general courts martial convening authority, or 
Senior Executive Service. Within industry, such deter- 
minations must be approved by the DoD contracting 
office, and reported to the DIS regional office with 
security responsibility for the contractor concerned. 
Each such determination shall be recorded and main- 
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Eligibility for Security Clearances 


Current DoD policy permits immigrant aliens 
(i.e., foreign nationals admitted into the United States for 
permanent residence) to receive SECRET security 
clearances based upon DoD’s need to utilize the special 
expertise possessed by that individual, provided DoD has 
the ability to establish investigative coverage for the 
previous 10 years. Currently, native-born and natural- 
ized United States citizens may be cleared at any level; no 
distinction is made based upon country of origin and no 
additional residence requirement exists for naturalized 
citizens (who typically must have maintained residence in 
the United States for a minimum of five years as a condi- 
tion of naturalization). Dual citizens are treated as United 
States citizens. Foreign nationals who are employed by 
DoD do not receive security clearances, per se, but, with 
high-level approval, may receive a “Limited Access 
Authorization”, which entitles them to access up to 
SECRET level information for a specific purpose. 

Although there are relatively few cases where these 
policies are known to have led to penetrations of DoD by 
hostile agents, they undoubtedly increase that risk. 
Policies can be tightened without jeopardizing DoD’s use 
of such individuals, with due regard for their rights as 
recognized under United States law. 


¢ RECOMMENDATIONS: 


oO 6. Establish policies that provide: 

a. Only United States citizens are eligible for 
standard security clearances and that immigrant aliens 
and foreign nationals employed by the DoD are eligi- 
ble only for “Limited Access Authorizations” not ex- 
ceeding the level of classified information which may 
be released to the country of current citizenship. Such 
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10 years of investigative coverage is feasible; and, 
where SECRET information is at issue, the subject 
agrees to a counterintelligence-scope polygraph ex- 
amination. 


b. Recently naturalized United States citizens, 
whose country of origin is determined by appropriate 
authority to have interests adverse to the United 
States, or who choose to retain their previous citizen- 
ship, shall ordinarily be eligible for a security clearance 
only after a five-year period of residence within the 
United States after becoming a citizen; otherwise, a 
minimum of 10 years of investigative coverage is feasi- 
ble. 

c. Exceptions to these requirements shall be 
permitted for compelling national security reasons. 


Initial Investigations 


Largely due to requirements originating from the 
DCI (for SCI access) and the Office of Personnel 
Management (OPM) (for civilian employees of DoD), 
DIS conducts three different types of background in- 
vestigation for TOP SECRET clearance. A SECRET 
clearance is granted on the basis of only a National Agen- 
cy Check (NAC); a CONFIDENTIAL clearance is 
similarly based upon a NAC. 

Unless the existence of potentially derogatory in- 
formation is indicated by the subject on his personal 
history statement, the sum total of investigation per- 
formed by DIS for a SECRET clearance consists of a 
check of FBI criminal records and a check of the Defense 
Central Index of Investigations, which would indicate 
any previous investigations by DoD elements. Thus, 
unless the subject himself suggested the existence of possi- 
ble derogatory information, the NAC would likely turn 
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system. The Department has long recognized the inade- 
quacy of the NAC. However, since there are more than 
three million persons with SECRET clearances and more 
than 900,000 SECRET clearances are granted each year, 
adding field investigations for SECRET clearances could 
require as much as a quadrupling of DIS investigative 
resources. Thus, expansions of the investigations re- 
quired for SECRET clearances have been heretofore 
regarded as infeasible. 

On the average, the background investigation for 
TOP SECRET currently takes 90 days. A NAC, re- 
quired for a SECRET clearance, presently averages 60 
days. If the case turns up derogatory information that 
must be further developed, or if it involves investigative 
leads abroad or that are otherwise difficult to accomplish, 
the processing time may be considerably extended. In- 
dividuals who are awaiting completion of their security 
checks may not have access to classified information. In- 
terim clearances may be awarded, however, based upon 
case-by-case justification, allowing interim access to TOP 
SECRET information based upon the submission of a 
“clean” personal history statement and a NAC, and in- 
terim access to SECRET based upon submission of a per- 
sonal history statement, without having to await comple- 
tion of the field investigation. If derogatory information 
should turn up in the course of the field investigation, the 
interim clearance is immediately withdrawn pending 
resolution of the case. Although precise figures are not 
available, it is clear that the costs to DoD, in terms of lost 
production capability that result from employees and con- 
tractors awaiting for background investigations to be 
completed, are substantial. 

Given the relatively small number of cases in 
which derogatory information is developed by the initial 
investigation where the personal history statement in- 
dicates no adverse information, the Commission believes 
the Department would incur small risk in providing in- 
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level for a period of several weeks, based upon the sub- 
mission of a “clean” personal history statement. Adoption 
of this procedure DoD-wide would enable both DoD com- 
ponents and contractors to utilize their employees in 
cleared positions at a much earlier stage, avoiding con- 
siderable costs in terms of lost productivity. 

Normally, DIS investigators doing background in- 
vestigations receive excellent cooperation both from of- 
ficial and private sources of information. There has been 
a long-standing problem, however, with several state and 
local jurisdictions that refuse to provide DIS with certain 
criminal history information concerning the subjects of 
background investigations. Frequently these problems 
arise from state or local law, or the interpretations of such 
law made by local authorities, precluding the release of 
criminal history data which did not result in convictions 
or release for other than law enforcement purposes, even 
though the subject has consented to the release of such 
data. Where this problem exists, DoD is forced to deter- 
mine the clearance without benefit of potentially signifi- 
cant criminal history data. 

The Intelligence Authorization Bill for FY 1986, 
as reported from the conference committee, contained a 
provision which provides DoD, OPM, and CIA in- 
vestigators access to state and local criminal history 
records notwithstanding state or local laws to the con- 
trary. If enacted, this measure should provide DoD with 
the legal authority needed to access such data. 


e RECOMMENDATIONS: 


o 7. Obtain the consent of the DCI and OPM for a 
single-scope background investigation for both TOP 
SECRET and SCI access, to ensure the same type of 
investigation is done on all categories of DoD person- 
nel, including contractors, who have access to TOP 
SECRET information. Until the NSC prescribes a dif- 
ferent scope applicable to the entire Executive Branch, 
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such investigations should cover a time frame and be 
composed of only those elements which have been 
demonstrated to be effective in determining the bona 
fides of the subject or produce significant derogatory 
information. 

8. Immediately expand the investigatory re- 
quirements for SECRET clearance to include a NAC, 
credit check, and written inquiries to present and past 
employers. Assess the desirability and feasibility of re- 
quiring the subjects of investigations for SECRET 
clearances to themselves provide greater evidence of 
their identity and bona fides as part of the pre- 
investigative process. 

9. Apply the procedures now used for granting in- 
terim SECRET clearances based upon a case-by-case 
justification to the processing of all such clearances. 
10. Press efforts to obtain statutory authority to obtain 
criminal history data from state and local jurisdictions, 
as proposed in the pending Intelligence Authorization 
Bill for FY 86. With such authority, DIS should 
resolve any problems it may have obtaining access to 
relevant criminal history data with the state and local 
jurisdictions concerned. 


Adjudication 


The results of background investigations requested by 
DoD components are returned to central adjudication 
points* within each DoD component for processing in ac- 
cordance with DoD Regulation 5200.2-R, the basic DoD 
personnel security regulation. The investigative reports 
on contractor employees which contain significant 
derogatory information are sent to the Defense Industrial 
Security Clearance Review (DISCR) Office where they 
are adjudicated in accordance with DoD Directive 


*The Navy, which has had a decentralized adjudication system for military personnel, 1s in the proc- 
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5220.6. Both DoD Regulation 5200.2-R and DoD Direc- 
tive 5200.6 contain adjudicative guidelines for those 
charged with making clearance determinations. The ad- 
judicative criteria in DoD Directive 5200.6 have recently 
been revised to mirror those in DoD Regulation 
5200.2-R, with the exception of the criteria relating to 
criminal misconduct. Under the industrial criteria, a per- 
son who is convicted of a felony, or admits to conduct 
which would constitute a felony under state or local law, 
cannot be granted a security clearance unless a waiver is 
approved by the Under Secretary of Defense for Policy 
for compelling national security reasons. Under the 
guidelines applying to military and civilian personnel, 
such conduct is considered a factor, but not in itself deter- 
minant of the clearance decision. 

Experience has demonstrated that the adjudica- 
tion criteria in both regulations are stated so generally 
that it is possible for different adjudicators to arrive at dif- 
ferent determinations after applying the same guidelines 
to a given set of investigative results. 

DoD requires no formal training for persons per- 
forming adjudicative functions. Indeed, no such training 
is conducted beyond an occasional seminar. The applica- 
tion of adjudication guidelines thus becomes largely a 
matter of on-the-job training. Moreover, the grade levels 
of adjudicators appear uniformly low, considering the 
degree of judgment and skill required. (See discussions on 
“Training” and “Career Development” below.) 

All of these factors tend to produce inconsistent, 
uneven results in terms of adjudications. While no precise 
analysis of the extent of this problem was available to the 
Commission, there is little confidence that the adjudica- 
tion process in many DoD components guarantees the 
same results based upon a given set of investigative find- 
ings. The imprecision of adjudicative standards partially 
explains why relatively few clearances are denied on the 
basis of the initial investigation. In the absence of definite 
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sense” yardstick, may be inclined to conclude that access 
by the subject is “not clearly inconsistent” with the na- 
tional security, regardless of the investigative findings in- 
volved. In fact, with respect to DoD components, only 
2.5 percent of the initial clearance determinations 
resulted in denials in 1984. With respect to contractors, 
only 0.2 percent of the cases resulted in denials. 
Clearly, there is a pressing need to improve the 
adjudication process, the ultimate step in determining an 
individual’s trustworthiness for access to classification in- 
formation. The key requirement is the enunciation of 
more precise criteria and, particularly, better definition of 
behavior which is, per se, not consistent with the national 
security. This is a fertile area for research, as there is 
scant empirical data available on which to base sound 
standards. One approach to this task might be to analyze ° 
the “Statements of Reasons” issued by the Defense In- 
dustrial Security Clearance Review Office to justify the 
denials of industrial clearances. Such analysis should 
begin to produce more concrete, better defined criteria 
for denials which have also been subjected to legal review. 


¢ RECOMMENDATIONS: 


© 11. Revise the criteria which govern the adjudication 
of security clearances to provide far more specificity 
than is currently the case, to the end of more uniform 
and consistent security clearance determinations. (See 
also Recommendation 59, under “Training”, and 
Recommendation 58, under “Research”, below.) 
12. Consolidate the adjudication functions for civilian 
employees of the Office of the Secretary of Defense, 
and all defense agencies except the Defense In- 
telligence Agency and the National Security Agency, 
who are cleared at the collateral level under the Direc- 
tor, Washington Headquarters Services (WHS). En- 


force the current requirement that the Military 
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clearances for military personnel assigned to other 
elements of DoD. 


Periodic Reinvestigations 


Recent espionage cases have involved persons 
with security clearances who were recruited by or offered 
their services to hostile intelligence services. The Depart- 
ment has an obvious need to ensure that persons who are 
being initially cleared have not been recruited and are not 
vulnerable to recruitment by hostile intelligence. As a 
practical matter, however, the greater and more probable 
threat to DoD security is the individual who is recruited 
after he has been cleared. Nevertheless, DoD has devoted 
relatively small investigative resources to reinvestiga- 
tions. 

Since 1983*, the Department has required rein- 
vestigations at five-year intervals of persons holding TOP 
SECRET clearances and SCI accesses. These are com- 
prehensive investigations, but have so far resulted in very 
few terminations. Moreover, DIS is far behind schedule 
in completing these reinvestigations. 

Since 1983, DIS has conducted roughly 27,000 
such investigations a year. But given there are approx- 
imately 700,000 persons in the affected categories, it 
would be impossible to eliminate the backlog if the same 
level of effort continues. Fortunately, the Congress has 
approved an additional 25 million dollars for DIS in fiscal 
year 1986 to be applied to the existing backlog of periodic 
reinvestigations. If this level of effort remains constant, 
DIS expects to be back on schedule in five years. 


* DoD had in the past conducted periodic reinvestigations of very limited scope for SCI access. In 
1981, a moratorium was placed on these investigations in order to deal with the enormous backlog of 
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No periodic reinvestigations are required for 
SECRET or CONFIDENTIAL clearances, and, given 
the volume of such clearances now in existence (3.3 
million SECRET and 400,000 CONFIDENTIAL), an 
across-the-board requirement to conduct reinvestigations 
for SECRET clearances will not be feasible without a 
substantial increase in DIS investigative resources. 
However, it should be feasible to conduct some 
reinvestigations in the SECRET category where the sub- 
ject has access to information of unusual sensitivity. 


¢ RECOMMENDATIONS: 


© 13. Accord periodic reinvestigations significantly in- 
creased priority: 

a. Mandate that the backlog of reinvestigations 
due on persons holding TOP SECRET clearances and 
SCI access be reduced to manageable levels within four 
years. 

b. In the interim, authorize the heads of DoD 
components to request periodic reinvestigations on a 
case-by-case basis of persons holding SECRET 
clearances who, nonetheless, are exposed to very sen- 
sitive information. 

c. Establish a goal of conducting periodic 
reinvestigations of all persons holding SECRET 
clearances and above by 1995. 


Use of the Polygraph as a 
Condition of Continuing Access 


Polygraph examinations have been used in DoD for 
many years for a variety of purposes. Prior to 1985, 
however, the polygraph was not used within DoD as a con- 


dition of continuing access to classified information except 
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at the NSA, and, since 1981, in a sensitive Air Force 
project. 

While there were no legal restrictions on DoD use 
of the polygraph for this specific purpose before 1984, and 
it had been required for applicants for employment at both 
CIA and NSA for many years, DoD had refrained from 
using a broad lifestyle polygraph examination to supple- 
ment its personnel security program, largely out of con- 
cern for the privacy of, and fairness to, employees already 
on the rolls. In 1982, however, the Department proposed 
a modest expansion of the use of polygraph examinations, 
limited to questions of a counterintelligence (rather than 
personal) nature, and set forth a variety of procedural 
safeguards to ensure that its employees were treated equita- 
bly and with a minimum of personal intrusion. The ob- 
jective was to authorize DoD components to use such 
examinations, under the ground rules established, as a con- 
dition of access to specially designated programs of high 
sensitivity. 

This proposal, although endorsed by DoD com- 
ponents, was not implemented at the time because of con- 
gressional concerns regarding expanded use of the 
polygraph. After a number of hearings and consultations, 
however, the Department reached general agreement 
with the relevant congressional committees for a test of 
this concept in fiscal year 1985, limited to 3,500 
counterintelligence-scope examinations. Authority to 
conduct such a test was included in the FY 1985 Defense 
Authorization Act. 

Although the initial test had not been completed, 
the Armed Services Committees agreed, in conference ac- 
tion on the FY 86 Defense Authorization Bill, to extend 
the test program at the same 3,500-examination level for 
FY 86 and increase it to 7,000 for FY 87. 

Based upon this action, DoD has directed the 
Army to serve as Executive Agent for polygraph training, 
and expand its training facility to accommodate 108 
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required to carry out the 7,000 examinations authorized 
in FY 87. DoD components were encouraged to analyze 
their requirements and ensure they are satisfied. 

While these actions are going forward, it is clear 
that the limited, year-to-year authorization, apparently 
favored by the Armed Services Committees, is impeding 
the planning and successful execution of the expansion of 
the DoD training facility, and, accordingly, the program 
as a whole. It is simply not feasible to concert long-term 
arrangements and attract high-caliber personnel to com- 
mit to them, based upon an uncertain, year-to-year 
authority. 

The Commission is convinced that the counter- 
intelligence-scope polygraph is the primary technique 
currently available to the Department which offers any 
realistic promise of detecting penetrations of its classified 
programs by hostile intelligence services. Moreover, even 
the possibility of having to take such examinations will 
provide a powerful deterrent to those who might other- 
wise consider espionage. Accordingly, the Commission 
urges that a substantial, albeit gradual, expansion of the 
Department’s program should be undertaken. 

Obviously, because of the very limited capability 
DoD now possesses to conduct polygraph examinations, 
its limited ability to train new examiners in the near- 
term, and its determination to maintain the stringent 
quality controls that characterize this program, DoD will 
be constrained to relatively small numbers of examina- 
tions for some time to come. It makes sense, therefore, to 
utilize them on a systematic basis only for specially- 
designated TOP SECRET and Special Access Programs 
as the Congress has approved. It would also be desirable, 
however, for persons cleared at the SECRET and TOP 
SECRET levels to face the possibility of a randomly ad- 
ministered polygraph examination at some time during 
their careers. Similarly, there may be programs classified 
at the SECRET level which themselves are of peculiar 
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participants. Under the formulation contained in the FY 
1986 Defense Authorization Act, a limited polygraph ex- 
amination within such categories would be barred. 


e RECOMMENDATION: 


o 14, The Department should request the Armed Serv- 
ices Committees of the Congress to supplant the cur- 
rent year-to-year approach, which limits both the 
numbers and categories of personnel who might be 
asked to take counterintelligence-scope polygraph ex- 
aminations, with continuing discretionary authority 
lodged in the Secretary to make such determinations, 
subject to congressional oversight. 


Establishing Special Controls 


Governing Access to Cryptographic 
Materials 


Prior to 1975, the Department had special 
designations for persons who had access to, or were custo- 
dians of, cryptographic materials and equipment. Persons 
whose duties required such access were formally author- 
ized access and required to sign briefing statements 
acknowledging their special responsibilities to protect this 
type of information. The program was discontinued in 
1975, on the grounds that the administrative burden of 
the comprehensive program, which at that time included 
hundreds of thousands of DoD employees, did not justify 
the rather small benefits that were perceived. 

It is clear, nonetheless, that cryptographic infor- 
mation continues to have crucial significance inasmuch as 
its compromise to hostile intelligence services can, in 
turn, lead to the compromise of any classified information 
being transmitted over secure voice or secure data chan- 
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The Commission, thus, unanimously favors the 
reinstitution of special controls to govern access by DoD 
employees and contractors whose duties involve con- 
tinuous, long-term access to classified cryptographic in- 
formation in large quantities or with highly sensitive ap- 
plications. Only U.S. citizens would be eligible for access, 
and they must, among other things, agree at the time ac- 
cess is given to take a counterintelligence-scope polygraph 
examination if asked to do so during their period of ac- 
cess. A “crypto-access” program with more focused 
coverage than before, which also provides greater deter- 
rence, would fully justify the administrative burdens en- 
tailed. 


e RECOMMENDATION: 


© 15. Institute without delay a new “crypto-access” pro- 
gram. 


Continuing Command/Supervisory 
Evaluations 


Commanders and supervisors at all levels of DoD 
and defense industry are charged by regulations with 
reporting to appropriate investigative authorities adverse 
information which could have a bearing upon subor- 
dinates’ worthiness to retain a security clearance. Based 
upon the experience both of DIS and the military in- 
vestigative agencies, relatively little such information is 
actually reported. For example, only about four percent 
of cleared defense contractors have reported such data. In 
part, this is due to the reluctance of commanders/super- 
visors to report matters, especially of a personal nature, 
which could affect their subordinates’ reputations or have 
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many commanders/supervisors are not sensitive to the 
significance of their subordinates’ conduct from a security 
point of view. With respect to industry in particular, 
where the loss of a security clearance could mean the loss 
of a job, many employers are reluctant to report adverse 
information to the government for fear of prompting 
lawsuits by the affected employee. Finally, as a practical 
matter, contractors typically exercise very little super- 
vision over cleared employees assigned in overseas loca- 


tions. 
To encourage such reporting by industry, DoD 


clarified its policy in 1983 to state that it does not expect 
the reporting of rumor or innuendo regarding the private 
lives of cleared industry employees. Still, it does expect to 
receive reports of information which are matters of official 
record or of problems which have required professional 
treatment. Relatedly, cleared contractors do not now 
review that portion of an employee’s personal history 
statement (i.e., “the privacy portion”) that contains per- 
sonal data (e.g., certain criminal history data, use of 
drugs) unless the employee consents to such review. As a 
consequence, information concerning the employee’s 
background which may be known by the company and 
which would supplement or contradict that provided by 
the employee on the form is not being collected from the 
employer at the time the clearance is requested. The ra- 
tionale for this policy is that DoD will obtain more infor- 
mation from contractor employees if they can be assured 
their employer will not have access; and, secondly, to pre- 
vent the employer from using such information for other 
purposes which could adversely and unfairly affect the 
employee, (e.g., terminate employment, reduce promo- 
tion chances). 

The Commission believes the lack of commanders’ 
and supervisors’ involvement in the security process is 
cause for concern because the command/supervisory 
system offers the most likely means of identifying security 
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cleared personnel. In virtually every recent espionage 
case, there has been evidence of conduct known to the 
commander/supervisor which, if recognized and 
reported, might have had a bearing on the continued ac- 
cess of the individual concerned and could have resulted 
in detection of espionage activities. 

The Commission has already recommended, and 
the Deputy Secretary of Defense has approved, two ac- 
tions to treat this problem. The first requires annual 
military and civilian performance and fitness reports be 
revised to incorporate a requirement for the commander 
supervisor to comment upon subordinates’ discharge of 
security responsibilities. The second requires com- 
manders and supervisors to review all personnel history 
statements submitted by subordinates with TOP 
SECRET clearances for purpose of initiating the required 


5-year reinvestigations. If the commander/supervisor is 


aware of additional information concerning the employee 
which may have security signficance, he will be required 
to provide such information at the time the reinvestiga- 
tion is requested. A copy of the Deputy Secretary’s actions 
is included at Appendix D. 

An additional and important means of involving 
commanders and supervisors in DoD components would 
be to institute a program modelled after the DoD Person- 
nel Reliability Program (PRP) which is designed to en- 
sure that persons with access to nuclear weapons remain 
trustworthy and stable while performing such duties and 
which has proved its effectiveness over the years. Under 
this program, the commander/supervisor is required to 
make an initial evaluation of the individual and certify 
that, after review of the individual's pertinent records, he 
is fit for his anticipated duties. Periodic evaluation of par- 
ticipating personnel focuses upon indicators of possible 
unsuitability for continued duties. The same concept 
could be applied to a wide range of classified programs, 
although, given the resources required, it would likely 
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particular sensitivity. 
e¢ RECOMMENDATIONS: 


o 16. Require cleared contractor facilities to adopt pro- 

cedures designating one or more individuals to act as 
agent(s) of the government, who shall be responsible 
for reviewing and comparing all information provided 
by applicants for security clearances on their personnel 
history statements with other information known to the 
company, to ensure such information is accurate and 
complete; moreover such procedures should specify 
that any applicant may indicate on the form that he or 
she has information not included but wishes to discuss 
with a government investigator. Prohibit any use or 
dissemination of such data within the cleared contrac- 
tor other than for this specific purpose. 
17. Direct appropriate DoD components to institute a 
‘‘reliability’’ program for military and civilian person- 
nel involved in especially sensitive programs or assigned 
to TOP SECRET positions of high criticality. It should 
embrace elements of, but be less structured than, the 
DoD Personnel Reliability Program (PRP). 


Acquiring Information from 
Additional Sources 


There are no formal channels in DoD for in- 
dividuals to report information of security signficance ex- 
cept through their command or organizational channels. 
Similarly, employees in defense industry are advised to 
report information of security significance to their securi- 
ty officer or supervisor. This tends to discourage report- 
ing of pertinent information since the typical employee is 
reluctant to “inform” on fellow employees, and, in most 
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significant enough to justify the unpleasant consequences 
which may follow. 

One means of stimulating such reports would be to 
obtain congressional authority to reward persons who 
provide information leading to an arrest for espionage, or 
the identification of hostile intelligence agents. There is 
legal precedent for this approach to obtaining information 
on terrorists, tax evaders, and other types of criminal 
behavior. Rewards may encourage more reporting of 
significant information by employees who now convince 
themselves that information in their possession is too “in- 
significant” to warrant getting involved. 

Also, DoD has no formal, systematic means of ob- 
taining relevant information concerning cleared person- 
nel from law enforcement or regulatory agencies of 
federal, state, and local government. DoD should have a 
means of learning of misconduct which is already a mat- 
ter of public record, whether or not it is also reported by 
the commander or supervisor. Similarly, other informa- 
tion with potential security significance is available within 
the federal government (e.g., loan defaults, stock owner- 
ship by foreign interests, tax liens), but DIS routinely 
does not seek or obtain access. 


© RECOMMENDATIONS: 


© 18. DoD components and industry should establish 
appropriate alternative means whereby information 
with potentially serious security significance can be 
reported other than through command or organiza- 
tional channels, e.g., drop boxes, post cards, or 
designated telephones. In the latter case, the “hotline” 
established by the DoD Inspector General to receive 
reports of fraud, waste, and abuse could be used to 
receive such reports of an unclassified nature, which 
would then be transmitted to the appropriate military 
counterintelligence element or the DIS for follow-up as 
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19. DoD should seek legislative authority to establish 
a program of monetary rewards for its personnel and 
contractor employees who provide information leading 
to the apprehension of persons engaged in espionage, 
or the identification of a hostile intelligence agent. 

20. DoD should seek Department of Justice coopera- 
tion in obtaining public record criminal justice infor- 
mation involving cleared DoD employees and contrac- 
tors. Similarly, DoD should press for DIS access to 
other automated data banks of the federal government 
which contain information of potential security 
significance concerning cleared employees. 


Managing and 
Controlling Classified 


Information 


The majority of DoD’s policies and procedures for 
managing and controlling classified information imple- 
ment Executive Order 12356, which prescribes policy and 
procedure for the entire Executive Branch. The Executive 
Order, among other things, establishes the levels of 
classified information and delegates the authority to 
classify information to the heads of departments and 
agencies, including the Secretaries of Army, Navy, and 
Air Force, who may further delegate such authority as 
necessary. The order further provides that information 
shall be classified if it falls into certain prescribed 
categories (e.g., “military plans, weapons or operations; 
vulnerabilities or capabilities of systems; installations, 
projects or plans relating to the national security”) and its 
unauthorized disclosure could reasonably be expected to 
damage the national security. Dissemination of such in- 
formation is limited to those who are determined to be 
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to-know” such information in the performance of official 
duties. Transmission of such information by either elec- 
tronic means or by physical relocation must utilize 
methods which will prevent the disclosure of the informa- 
tion concerned to unauthorized persons. Such informa- 
tion must be stored in approved containers or under other 
approved conditions, and must be safeguarded to the ex- 
tent necessary to prevent unauthorized access. 

With some exceptions, these safeguarding re- 
quirements are essentially the same for DoD components 
and cleared DoD contractors. The latter are bound by the 
terms of their contracts to perform classified work and to 
abide by DoD industrial security regulations. 

Executive Order 12356 also permits the heads of 
departments and agencies to establish “Special Access 
Programs” to protect “particularly sensitive” classified in- 
formation; such programs are subject to “systems of ac- 
counting” established by agency heads. 

Executive Order 12356 does not explicitly treat the 
the transmission of United States classified information to 
foreign governments, apart from providing that classified 
information shall not be disseminated outside the Ex- 
ecutive Branch unless it is given “equivalent” protection 
by the recipient. More detailed policy governing the 
foreign release of classified military information is found 
in the National Disclosure Policy, promulgated by the 
President and administered for the Secretaries of Defense 
and State by the National Disclosure Policy Committee, 
chaired by a representative of the Secretary of Defense. 


Classification 


There are no verifiable figures as to the amount of 
classified material produced in DoD and in defense in- 
dustry each year. DoD reported an estimated 16 million 
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a sampling of message tratfic from selected automated 
systems. DoD concedes the actual figure may vary con- 
siderably. In any case, it is clear that the volume of 
classified documents is enormous. Obviously, the Depart- 
ment needs to protect much of what it is doing with 
classification controls. Nonetheless, too much informa- 
tion appears to be classified and much at higher levels 
than is warranted. Current policy specifies that the signer 
of a classified document is responsible for the classifica- 
tion assigned but frequently, out of ignorance or expe- 
dience, little scrutiny is given such determinations. 
Similarly, while challenges to improper classifications are 
permitted, few take the time to raise questionable 
classifications with the originator. 

The Secretary of Defense and Secretaries of the 
Military Departments have granted the authority to make 
“original” classification decisions, (i.e., to decide at the 
outset whether and at what level a program, project or 
policy is to be classified) to 2,296 “original classification 
authorities”, including 504 officials with TOP SECRET 
classification authority and 1,423 with SECRET authori- 
ty. Over the last 10 years DoD has pared down the 
number of officials with original classification authority; 
further reductions can be made. Given the fact that 
relatively few original classification decisions are actually 
made each year and these typically govern new programs 
and projects, such decisions necessarily ought to be made 
or approved by a limited number of senior-level officials. 
At present, there appear to be original classification 
authorities in some DoD components who are not in posi- 
tions to exercise such control. 

All persons who create new classified documents 
based upon an original decisions to classify a program, 
project or policy are bound to carry over the “original” 
classification decision to the document being created. 
This process is called “derivative classification”, and com- 
prises by far the bulk of classification activity carried out 
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DoD requires that original classification 
authorities issue classification guides prior to the im- 
plementation of a classified program and project, setting 
forth the levels of classification to be assigned to the 
overall project and to its component parts. Currently 
1,455 such guides are in existence, however, many of 
these are incomplete and seriously outdated, notwith- 
standing the DoD requirement that they be reviewed 
biennially. Generally, classification guides do not cover 
policy determinations and actions ensuing therefrom. 

Cleared DoD contractors do not have “original 
classification authority” and must apply the classifications 
given them by the cognizant project or program office to 
the documents they create. This classification guidance is 
provided in the form of a contract security specification to 
all classified contracts (DD Form 254), which is intended 
to provide the contractor with specific classification 
guidance, including the applicable classification guide, 
and the identification of the individual to be contacted if 
questions arise regarding classification. While logical in 
concept, this system is flawed in practice, being depend- 
ent largely upon the thoroughness and diligence of the 
contracting office to provide the required guidance. 
Although DIS regional offices have “classification 
managers” assigned to facilitate the interchange between 
contractor and program office, they are not in a position 
to provide such guidance or to motivate the contracting 
office to become more deeply involved. The contractor, 
though desiring answers, is often not inclined to bother 
his DoD benefactor. 

In general, shortcomings in the area of classifica- 
tion are primarily a matter of inadequate implementation 
of existing policy, rather than a matter of deficient policy. 
(These inadequacies are generally addressed in Recom- 
mendation 53, below, under “Command/Supervisor Em- 
phasis.”) 

The remedy is straightforward: disciplined com- 

50 Approved For Releastizne6 024 checralppP96B01172R000100090004-9 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


e RECOMMENDATION: 


© 21. Require, rather than simply permit, challenges to 
classifications believed to be improper. 


Dissemination of Classified 
Information 


Classified information may be disseminated only 
to someone with a security clearance at the level of the in- 
formation concerned who has a “need-to-know” such in- 
formation in the performance of official duties. TOP 
SECRET information is strictly accounted for both in 
DoD and in industry by a system of receipts, serializa- 
tion, disclosure records, and inventories. Control pro- 
cedures for SECRET and CONFIDENTIAL informa- 
tion are left to DoD components and, in practice, vary 
widely. Cleared DoD contractors, however, are required 
to maintain a chain of accountability for all SECRET 
documents. 

Reproduction of TOP SECRET information 
under existing policy must be approved by the originator 
of the information in question. Reproduction of 
SECRET and CONFIDENTIAL documents is not so 
restricted, and reproduction controls, if any, are left to 
components to determine. 

Most classified documents produced within DoD 
are multi-addressee memoranda, messages or publica- 
tions, whose recipients could number in the hundreds. 
They are routinely handled by clerical and administrative 
personnel, as well as the staffs of the named addressees. 
Often such documents are distributed to recipients who 
have simply indicated they have an “interest” in the 
general subject matter covered in this and recurring 
reports without any critical evaluation of their need-to- 
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know. Similarly, with respect to message traffic, often lit- 
tle confirmation of “need-to-know” is done initially or ona 
continuing basis. Getting on the list usually guarantees 
access, regardless of actual need. 

Classified information is exempted from release to 
the public under the Freedom of Information Act 
(FOIA), and, obviously, is not permitted to be released in 
open congressional testimony or in articles intended for 
open publication. While DoD has mechanisms to provide 
security review of each of these potential channels to pre- 
vent improper dissemination, there are occasions when 
such disclosures occur due to human error or negligence. 
In 1984, CIA obtained congressional approval to exempt 
certain categories of its files from review under the FOIA, 
but DoD has no similar authority for its highly sensitive 
files. To require that such information be submitted to 
classification review is ultimately a waste of DoD 
resources since it cannot be released under any cir- 
cumstances, and it risks the possibility that through 
human error it might be inadvertently disclosed. 

In a related vein, although Executive Order 12356 
provides that departments and agencies may disseminate 
classified information to persons outside the Executive 
branch provided such information is given “equivalent 
protection” by the recipient, DoD elements frequently 
provide classified information to the Congress without 
any understanding of how such information will be pro- 
tected. While all congressional staff members who receive 
access to classified DoD information are, in theory, 
cleared by DoD, little attention is given the handling and 
storage of such information by congressional staffs, who 
are not, in fact, bound by the safeguarding requirements 
of Executive Order 12356. The Roth/Nunn Subcommit- 
tee report cited this deficiency as requiring the attention 
of the Congress. 
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e RECOMMENDATIONS: 


© 22. Require DoD components to institute a uniform 
minimum degree of accountability for SECRET 
documents, which shall provide: (1) a means to verify 
that any such document sent outside a major subor- 
dinate element of the DoD component concerned has 
been received; (2) a record of distribution outside such 
elements, where such distribution is not otherwise evi- 
dent from the address line or distribution list; and (3) a 
method of varying the destruction of such documents. 
23. Direct DoD components and contractors to im- 
pose better controls over reproduction equipment used 
to copy classified information, such as (1) establishing 
classified reproduction facilities where only designated 
clerks could reproduce classified materials; (2) in- 
stituting key control over reproduction facilities; or (3) 
requiring two people to be present when classified 
materials are being reproduced. Additionally, initiate 
long-term action to develop technical or mechanical 
controls over unauthorized reproduction built into the 
equipment itself. (See Recommendation 58, under 
“Research” below.) 
24. Press for legislation similar to that obtained by the 
CIA in 1984 to exempt certain categories of highly sen- 
sitive classified information held by the DoD from 
processing under the FOIA. 
25. Urge the President of the Senate and Speaker of 
the House of Representatives to adopt, for each House 
of Congress, rules to provide uniform minimum con- 
trol over classified information provided by depart- 
ments and agencies of the Executive Branch. 
Volunteer to provide DoD resources and assistance to 
Congress to achieve this goal. 
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Transmission of Classified 
Information 


Classified information must be transmitted in a 
manner that precludes its disclosure to unauthorized per- 
sonnel. Classified telephone conversations between 
cleared persons must be over secure voice equipment. 
Classified electronic communications between ADP 
equipments must be transmitted over encrypted, or 
otherwise protected, circuits. Couriers, commercial car- 
riers, and others who handle and transport classified in- 
formation or material generally must be cleared to the 
level of the classified information concerned. There are, 
unfortunately, shortcomings— some serious—in each of 
these areas. 

Heretofore, there have been serious shortages of 
secure voice equipment needed to support DoD and its 
cleared contractors. This had led to “talking around” 
classified information over unsecured communications 
channels vulnerable to hostile intelligence intercept. The 
NSA has initiated a revolutionary effort to make low-cost 
secure voice equipment available to DoD components, 
and, on a direct-purchase basis, to cleared contractors. 
Although this effort is in its initial phases of implementa- 
tion, it promises a quantum increase in the capability to 
transmit classified information by secure voice means. 

There are also major problems in the area of 
automated systems security. While DoD and its contrac- 
tors have grown increasingly dependent on automated 
systems to process both classified and unclassified infor- 
mation, insufficient attention has been given to building 
security capabilities into computers and related distribu- 
tion systems. 

Computer security encompasses various internal 
technical measures as part of the architecture, design, and 
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currently susceptible to unauthorized manipulation in- 
clude computers, workstations, word processors, and 
storage transmission and communications systems used 
to create, process, transfer, and destroy information in 
electronic form. The technical flaws that render com- 
puters vulnerable often exist at the most complex, obscure 
levels of microelectronics and software engineering. Fre- 
quently even skilled engineers and computer scientists do 
not understand them. The subject is at the leading edge of 
technology. 

The National Computer Security Center (NCSC) 
has been established at NSA to develop standards for new 
“trusted” computer systems and to evaluate products for 
use within DoD. It will be years, however, before all ex- 
isting DoD systems are adequately analyzed and up- 
graded or replaced. 

Because the federal government accounts for only 
four percent of the domestic computer market, NSCS 
strategy from the outset has been to encourage major 
computer manufacturers to build enhanced security into 
their standard product lines. Working in cooperation with 
industry, the NCSC identifies vulnerabilities, develops 
countermeasures, establishes standards of trust, and pro- 
motes government and private sector awareness of the 
risks and opportunities. 

Adequate current funding for computer security 
research is essential, since the effect of research will not be 
realized in practice for 10 to 15 years. 

Information classified at the SECRET or CON- 
FIDENTIAL level may be appropriately wrapped and 
sent through registered and first class United States mail 
channels, respectively, so long as it remains entirely 
within United States postal control. 

Current policy requires that TOP SECRET 
documents be couriered by a person with appropriate 
clearance. There is no uniform policy or system, 
however, for selecting and authorizing such couriers. 
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material which is couriered long distances is handled by 
the Armed Forces Courier Service (ARFCOS) which 
operates worldwide under a charter issued by the Joint 
Chiefs of Staff. Although ARFCOS has, for the most 
part, been able to carry out its mission in a secure man- 
ner, it does not possess the physical facilities, communica- 
tions means, or secure vehicles necessary to protect effec- 
tively the very sensitive classified information in its trust. 
Commercial carriers in the United States which 
transport classified material are required to be cleared at 
the appropriate level. Through a system of receipts, 
minimal accountability is maintained from cleared sender 
to cleared recipient. Although it is patently impossible for 
DoD personnel to accompany all of the many shipments, 
checks could be made by DoD elements to determine 
whether the carrier complies with DoD requirements. 


e RECOMMENDATIONS: 


© 26. Support and facilitate the efforts of the NSA to 
provide low-cost, secure voice telephone equipment to 
components and to cleared defense contractors. 
27. Provider greater funding for the research and 
development efforts of the National Computer Securi- 
ty Center to improve the security of automated infor- 
mation systems. 
28. Direct OJCS to assess the adequacy of ARFCOS 
facilities, vehicles, aircraft, and distribution elements 
to protect the highly sensitive information which it 
transports. 
29. Require the DIS, the Military Traffic Manage- 
ment Command, or other appropriate DoD organiza- 
tions to conduct periodic compliance checks of 
classified or sensitive shipments in transit. 
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Retention and Storage 


Unless a classified document is marked for 
declassification upon a certain date or event, it will re- 
main classified until declassified by the originating office 
or higher authority. It may be retained, in theory, only 
while there remains a “need”. In practice, however, there 
are no real controls in DoD over the retention of classified 
information apart from the practical one of a place to 
store it. The required characteristics for such storage con- 
tainers are detailed in existing policy. 

There are statutory and DoD prohibitions regard- 
ing the destruction of “permanently valuable records” of 
the government, but the vast majority of classified 
documents held by DoD and its contractors do not qualify 
as such. The bulk of DoD’s classified holdings are not 
“record copies” of classified documents held by the 
originator; instead, they consist of the multitude of “addi- 
tional copies” of classified memoranda, messages, and 
publications that find their way into thousands of safes 
and filing cabinets. 

Under current policy, destruction certificates 
signed by two witnesses are required for the destruction of 
TOP SECRET information; for SECRET, one witness is 
required, unless the requirement for destruction cer- 
tificates has been waived to meet operational exigencies. 
As a practical matter, these requirements are not adhered 
to or enforced in many DoD components. 


e RECOMMENDATIONS: 


o 30. Prohibit the retention of classified documents 
which are not “permanently valuable records of the 
government” more than five years from the date of 
origin, unless specifically authorized in accordance 
with record disposition schedules established by the 
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© 31. Designate an annual classified information “clean- 
out” day, where a portion of the work performed in 
every office with classified information stored would be 
the destruction of unneeded classified holdings not 
otherwise required to be retained. 
32. Establish a general policy, subject to waivers 
prescribed by component heads, that employees not be 
permitted to work alone in areas where TOP SECRET 
or Special Access Program materials are in use or 
stored. 


Special Access Programs 


Authority to establish Special Access Programs is 
contained in Executive Order 12356, “National Security 
Information”. The intent is to ensure that sensitive ac- 
tivities are afforded greater protection than that normally 
accorded classified information. With few exceptions, 
such programs involve intelligence, military operations, 
research and development, and acquisition. ; 

Special Access Programs originating in DoD must 
be approved by the Secretaries of the Military Depart- 
ments or, in the case of other DoD components, by the 
DUSD(P) on behalf of the Secretary of Defense. 

Such programs have proliferated in DoD in recent 
years, apparently out of concern that “normal” security 
does not sufficiently protect the information at issue. In a 
few cases, the special security aspects of these programs 
consist of nothing more than access lists; most, however, 
involve elaborate security frameworks and requirements, 
and may involve substantial numbers of persons with ac- 
cess. Most involve defense industry and are typically ex- 
cluded from the Defense Industry Security Program by 
decision of the sponsoring department or DoD agency 
(hence the term “carve out” contract). 
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the DUSD(P) who maintains the “system of accounting” 
required by Executive Order 12356. DUSD(P) concedes 
that not all programs have been reported. Under DoD 
policy, each of the Military Departments is required to 
maintain a focal point office for administration of its own 
Special Access Programs. The DoD Inspector General 
has also created a special cell of cleared inspectors to con- 
duct audits of such programs. 

While the Commission is of the unanimous view 
that such programs are essential, they clearly present 
problems from a security viewpoint. 

First, although the sole rationale for the creation of 
Special Access Programs under Executive Order 12356 is 
to provide enhanced security, there is sometimes too little 
scrutiny of this determination at the time such programs 
are created. Unless an objective inquiry of each case is 
made by the appropriate authorities, the possibility exists 
that such programs could be established for other than 
security reasons, e.g., to avoid competitive procurement 
processes, normal inspections and oversight, or to ex- 
pedite procurement actions. With or without justifica- 
tion, there is considerable congressional sentiment that 
security is not the primary cause of the recent increase in 
Special Access Programs. Congress voiced such concern 
in its report on the FY 1984 Defense Appropriation Bill. 

Second, unless there are security requirements 
established and adhered to by all such programs which 
exceed the measures normally applied to classified infor- 
mation, then the purpose of creating such programs in the 
first place in negated. The Commission has received 
reports from some contractors that, in fact, some Special 


Access Programs are afforded less security protection 
than collateral classified programs. This anomaly results 
from either failure to utilize the security expertise of the 
sponsoring agency in the development of the security plan 
and in inspections, or delegation of responsibility to 
prime contractors to ensure subcontractors comply with 
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authorized for collateral classified contracts. 

Third, it is apparent from reports received by the 
Commission that there is no uniformity in the extra 
security measures stipulated by DoD components for 
Special Access Programs. The individually developed 
security requirements, aggravated by the proliferation of 
Special Access Programs, place an undue burden on con- 
tractors who are participating in a number of such pro- 
grams. 

Fourth, it is also essential that appropriate over- 
sight of the security administration of these programs be 
accomplished to ensure compliance with those security re- 
quirements which are imposed. Refusal to grant special 
program access to the DoD Inspector General for over- 
sight purposes must be reported to the Congress in ac- 
cordance with the statutory provisions of the Inspector 
General Act. 

Some progress is being made in each of these areas 
by a DUSD(P)-chaired Special Access Program Working 
Group. A draft set of minimum standards to apply to all 
Special Access Programs, including those with industry 
involvement, has been under discussion. The need for 
serious and continuing oversight is acknowledged. 


¢ RECOMMENDATIONS: 


© 33. a. The Secretary of Defense direct an immediate 
and one-time review and revalidation of all existing 
Special Access Programs and associated “carve out” 
contracts by the Secretaries of the Military Depart- 
ments and heads of other DoD components; results to 
be reported not later than March 31, 1986. 

b. The military departments should institute proce- 
dures to ensure the conduct of annual security inspec- 
tion and regularly scheduled audits by the departmental 
security, contract administration and audit organiza- 
tions; and submit an annual report, summarizing such 


inspections and audits, to the Deputy Secretary of 
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c. The DUSD(P) should expedite the development 
and promulgation of minimum security standards for 
DoD established Special Access Programs including 
those which involve defense contractors. 

d. Appropriate measures should be taken to relieve 
prime contractors of sole responsibility for subcontrac- 
tor compliance with Special Access Programs security 
requirements; and henceforth security inspections of all 
contractor participation in Special Access Programs be 
performed twice a year by professional security person- 
nel of the sponsoring component. 

e. DIS should establish a cadre of specially cleared 
and qualified inspectors for Special Access Programs 
with associated contracts; and inspection responsibility 
for these contracts should be transferred to or shared 
with DIS when deemed appropriate by the sponsoring 
component. 

f. Pursuant to his statutory requirements, the DoD 
Inspector General, in conjunction with the sponsoring 
department or agency, should conduct oversight audits 
of Special Access Programs. 


International Cooperation 
Involving the Transfer of 
Classified Information 


Transfers of classified military information to 
foreign governments are governed by the National 
Disclosure Policy, promulgated by the President, which 
provides the general criteria and conditions to govern 
such transfers, and delegates authority for DoD com- 
ponents to transfer certain categories of classified infor- 
mation to certain foreign recipients on their own ini- 
tiatives. Any contemplated transfer of classified informa- 
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the National Disclosure Policy must be considered and 
approved on a case-by-case basis by the National Dis- 
closure Policy Committee (NDPC), an interagency body 
chaired by a representative of the Secretary of Defense. 

The NDPC, as a major part of its functions, also 
conducts periodic surveys of the security framework 
within recipient countries to ensure that equivalent levels 
of protection can be and are being provided United States 
classified information. Based upon the surveys, the 
eligibility levels of recipient countries are adjusted. 

This framework is logical, and works reasonably 
well in practice. There is, however, room for improve- 
ment. 


The Commission was made keenly aware of the 
risk to United States classified information once it leaves 
United States control, even in the hands of friendly allied 


countries. Although the United States attempts to assure 
itself of both the capability and intent of recipient govern- 
ments to protect United States classified information 
prior to providing such information, as a practical mat- 
ters, the United States has little control over such infor- 
mation once in foreign hands, and has little expectation 
that it will learn of compromises. The problem is par- 
ticularly critical with respect to co-production ar- 
rangements, where losses could entail not only the end- 
item being produced but also the technical “know-how” 
necessary to manufacture it in large quantities. 

It is also not uncommon for Defense or State 
Department officials who deal with other governments 
regularly with respect to arms sales to suggest the United 
States is willing to sell classified weapons systems prior to 
obtaining the necessary approval of the responsible 
military service, and, as required, the NDPC. Such 
statements have the effect of skewing the NDPC approval 
process which then must consider the political conse- 
quences of failing to follow through on what the other 
government perceived as a United States commitment. 
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only modestly effective. Too few surveys are carried out, 
and there is insufficient flexibility in the program to 
satisfy DoD’s most pressing requirements. Even with 
respect to those surveys which are conducted, many lack 
the probing, objective analysis required, and, because 
survey team members (representing NDPC member 
agencies) return to their regular duties upon completion 
of the survey, survey reports are often outdated when. 
finally published. 


¢ RECOMMENDATIONS: 


© 34. The National Disclosure Policy should be amended 
to standardize the approach to be followed in approv- 
ing classifed transfers, to include: (1) requiring a deter- 
mination that the need of the recipient cannot be 
satisfied by unclassified systems or data; (2) if classified 
systems or data are required, then require selection of 
a model or type of such system that minimizes the need 
to transfer classified information; (3) require phasing 
in of the most sensitive classified information over 
time, if feasible; and (4) avoid co-production of 
military systems which involve the manufacture 
abroad of the most advanced version of classified com- 
ponents or end-items. While the Commission 
recognizes that the foreign disclosure process, in prac- 
tice, generally operates in accordance with these prin- 
ciples, placing them within the National Disclosure 
Policy should ensure greater adherence. 
35. NDPC surveys should be conducted and ad- 
ministered by a permanent, dedicated staff of security 
professionals assigned to the NDPC capable of produc- 
ing objective, timely reports. The survey schedule pro- 
gram must also be sufficiently flexible to meet pressing 
DoD requirements for in-country security 
assessments. 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-%3 


Approved For Release 2006/02/10 : CIA-RDP96B01172R000100090004-9 


Detecting and Countering 
Hostile Intelligence 
Activities Against DoD 


The FBI has primary United States government 
responsibility for keeping track of the activities of known 
or suspected hostile intelligence agents within the United 
States. However, DoD foreign counterintelligence agen- 
cies (the Army Intelligence and Security Command, the 
Naval Investigative Service, and the Air Force Office of 
Special Investigations) each conduct, in conjunction with 
the FBI within the United States and in coordination with 
the CIA abroad, counterintelligence operations and in- 
vestigations designed to identify and counter hostile in- 
telligence activities against their respective services. 

DoD components also dedicate substantial 
resources to security awareness briefing programs among 
their employees to sensitize them to potential hostile in- 
telligence activities. Their experience has been that the 
greater the reach of such programs, the more information 
concerning hostile approaches is reported. In industry, 
cleared contractors regularly receive “Security Awareness 
Bulletins” published by DIS; the military services also 
provide threat briefings to selected contractors, which are 
supplemented by the FBI’s Development of Counterintel- 
ligence Awareness (DECA) Program, which again in- 
volves briefings to selected defense contractors. 

In addition, a variety of measures are currently 
being implemented on a fragmented basis within DoD 
which are designed to provide indications of possible es- 
pionage activities. These include requirements to report 
contacts with foreign representatives; to report travel to 
designated countries or, in some cases, to any foreign 
country; the use of sources at sensitive projects to report 
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espionage; and the use of physical searches to determine if 
classified information is being removed from the premises 
without authority. 


Limiting and Controlling the Hostile 
Intelligence Presence within the 
United States 


DoD information is the primary target of the 
hostile intelligence presence within the United States. 
DoD, therefore, has a major stake in what United States 
actions are taken to reduce (or expand) the size of the 
hostile intelligence presence, as well as to limit (or ex- 
pand) its operational environment in the United States. A 
major step towards achieving reciprocity of treatment for 
diplomatic personnel was the establishment by statute of 
the Office of Foreign Missions within the Department of 
State in 1982. The diplomatic personnel of certain coun- 
tries are now required to obtain travel accommodations 
and needed services through the Office of Foreign Mis- 
sions, which handles such requests in a manner similar to 
the way in which United States diplomats are treated in 
the country concerned. 

Recently, additional measures have been in- 
stituted in both the Legislative and Executive Branches 
which would have the effect of further reducing or con- 
trolling the hostile intelligence threat. In the FY 1986 
State Department Authorization Bill, for example, two 
significant provisions impacting the hostile intelligence 
presence in the United States were added on congres- 
sional committees’ initiative. The first would apply to 
United Nations Secretariat employees who are nationals 
of a country whose diplomatic personnel are subject to the 
Office of Foreign controls, those same limitations and 
conditions, unless waived by the Secretary of State. The 
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equivalence” between the numbers of Soviet diplomatic 
personnel admitted into the United States, and United 
States diplomatic personnel admitted into the Soviet 
Union, unless the President determines additional Soviet 
diplomatic personnel may be admitted. 

Further restrictions ought to be instituted on the 
travel of non-Soviet Warsaw Pact nationals assigned to 
the United Nations secretariat or to the diplomatic mis- 
sions so accredited. The United States has heretofore 
refrained from imposing travel restrictions on any non- 
Soviet Warsaw Pact diplomatic and consular personnel in 
this country. The rationale has been that our diplomatic 
personnel accredited to East European governments are 
allowed considerable latitude of movement. A reciprocity 
principle is sound insofar as it applies to non-Soviet War- 
saw Pact diplomatic personnel accredited to the United 
States Government. Extention of the principle to person- 
nel at the United Nations is quite another matter. They 
are not accredited to the USG; their duties should be ex- 
clusively geared to the business of the UN; but, as a prac- 
tical matter, they constitute a substantial augmentation of 
the intelligence collection capabilities based at or directed 
from their nations’ embassies in Washington. The United 
States has no comparable means of augmenting its 
diplomatic missions in the non-Soviet Warsaw Pact coun- 
tries. Should those countries react to travel restrictions on 
its UN personnel by restricting our diplomatic and con- 
sular officials, the U.S. would be fully justified in taking 
similar action against those personnel of the countries 
concerned that are accredited to our government. 


® RECOMMENDATION: 


© 36. The Secretary should provide full support to Ex- 
ecutive and Legislative branch efforts—and where 
necessary initiate action—to reduce the freedom of ac- 
tion of hostile intelligence operatives within the United 
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By expanding the national policy of parity in 
numbers in the diplomatic establishments of the Soviet 
Union and the United States accredited to each other’s 
governments, to encompass parity in treatment and 
privileges. 

By extending this expanded policy of parity to 
all other nations who present a hostile intelligence 
threat to the United States. 


By requiring that personnel of the non-Soviet 
Warsaw Pact missions accredited to the United Nations, 
as well as personnel of those nations assigned to the Unit- 
ed Nations Secretariat, be subjected to the same travel 
restrictions as to those imposed on Soviet personnel serv- 
ing in those two capacities. 


Identifying and Monitoring 
Hostile Intelligence Agents 


The FBI has primary responsibility for identifying 
and monitoring known or suspected hostile intelligence 
agents within the United States. Counterintelligence 
elements of the military services also have trained cadres 
of counterintelligence specialists who conduct joint 
counterintelligence operations in the United States with 
the FBI involving DoD personnel or information. DoD 
agencies do not, however, routinely support the FBI in 
terms of monitoring the activities of known or suspected 
hostile intelligence agents unless such support is 
specifically related to a joint operation. Potentially, DoD 
has the capability to provide considerable support to help 
meet operational exigencies—not only with agents but 
also with technical and logistical assets. 


e RECOMMENDATION: 
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the feasibility of DoD counterintelligence elements 
playing a wider role in support of FBI responsibilities 
for monitoring the hostile intelligence presence within 
the United States during periods of unusually heavy 
activity. 


Counterintelligence Operations 
and Analysis 


Policy matters concerning the DoD foreign 
counterintelligence activities are coordinated through the 
Defense Counterintelligence Board, chaired by a 
representative of DUSD(P). The counterintelligence 
elements of the military services conduct both offensive 
and defensive counterintelligence operations and in- 
vestigations, the details of which are largely classified. 
They also analyze available information from these 
operations as well as from other agencies in the 
counterintelligence community, and provide counterin- 
telligence reports to their respective services (which are 
also shared with the community). The DIA, while having 
no operational counterintelligence role, plays a major role 
in the production of multi-disciplinary counter- 
intelligence analyses for DoD as a whole, and coordinates 
the production of finished reports by the service agencies. 

Although resources for the conduct of 
counterintelligence operations have increased in recent 
years, more are needed to fund additional analysis of 
operations to enhance the capability to utilize “lessons 
learned” from operational activities. This will provide bet- 
ter understanding of hostile intelligence targeting and 
modus operandi, as well as improved security to 
counterintelligence operations. 
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¢ RECOMMENDATIONS: 


© 38. Ensure, in development of the National Foreign 
Intelligence Program, there is increased funding for 
counterintelligence analysis. Relatedly, DIA should 
establish a Multidisciplinary Counterintelligence 
Analysis Center as a service of common concern for 
DoD, funded through the Foreign Counterintelligence 
Program, which will be responsive to the CI analytic 
requirements of the Defense Counterintelligence 
Board and the various DoD components. 
39. The Defense Counterintelligence Board should 
coordinate DIA and service activities to exploit opera- 
tions and evaluate technical advances being made by 
hostile intelligence services. 


Security Awareness Programs 


All DoD components with classified functions 
have some type of security awareness program, consisting 
typically of required briefings, briefings statements, 
audiovisual aids, posters, and publications of all types, 
describing the hostile intelligence threat. Although such 
programs are not centrally coordinated in DoD, substan- 
tial, if uneven, effort is devoted to them. Morever, they 
have proven reasonably effective in sensitizing personnel 
to possible hostile intelligence approaches. The military 
services report the number of contacts reported rises in 
proportion to the number of security awareness briefings 
which they are able to administer. 

Although DoD components should continue to be 
manage and administer their own security awareness pro- 
grams, DoD should facilitate and coordinate these pro- 
grams to avoid duplication of effort, and to improve the 
caliber of briefings and training aids. (See Recommenda- 
tion 57, below.) 
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While the DIS publishes periodically a “Security 
Awareness Bulletin”, sent to all cleared contractors, it is 
rarely seen beyond the company security office. Similar- 
ly, while the Military Departments and the FBI present 
threat briefings to selected DoD contractors, these reach 
only a small portion of the 1.2 million cleared contractor 
employees, usually being given to security or manage- 
ment officials. There is no overall coordination of security 
awareness programs within the defense industry. The 
Commission believes that considerable dividends in im- 
proved security could be achieved by a relatively small in- 
vestment to bolster the security consciousness of cleared 
contractor personnel through an effective security 
awareness program. 


¢ RECOMMENDATION: 


o 40. Direct DIS, in conjunction with the military 
departments and the FBI, to take action on an urgent 
basis to increase the size, effectiveness, and coordina- 
tion of the security awareness program in industry. 


Reporting Indications of 
Possible Espionage 


There are existing requirements for DoD 
employees and contractors to report suspected espionage. 
However, there are few specific or uniform DoD re- 
quirements applicable to all employees and contractors to 
report information which could indicate to experienced 
investigators the possibility of espionage activity and the 
need for further investigation. To the extent that such in- 
formation is being reported, the requirements to do so are 
largely a matter of component regulations, and, in the 
case of cleared ean the requirements of the In- 
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with representatives of foreign governments, particularly 
where efforts are made to elicit defense-related informa- 
tion, could indicate espionage activities. While most DoD 
components have some type of requirement to report such 
contacts, they are not uniform nor are they well enforced. 
In industry, there is no requirement to report such con- 
tacts short of the requirement to report possible evidence 
of espionage. 

Similarly, foreign travel at particular intervals and 
to particular locations could indicate to experienced in- 
vestigators possible espionage requiring follow-up. While 
many DoD components and defense industry have re- 
quirements to report travel by cleared personnel to 
Communist-bloc countries, very few components require 
reporting of travel to other foreign countries. 

Other indicators of possible espionage activities 
are not generally required to be reported, although such 
reports are occasionally made and acted upon. They in- 
clude such things as unexplained affluence; unexplained 
absences; attempts to solicit information beyond one’s 
need-to-know; and unexplained, unaccompanied visits to 
classified areas during non-work hours. In certain par- 
ticularly sensitive programs, some military counter- 
intelligence agencies ask a certain person(s) within such 
programs to watch for and report any such indicators 
directly to the investigative agency. Such sources are not 
utilized, however, in most DoD components or in in- 
dustry. 


¢ RECOMMENDATIONS: 


© 41. DoD should adopt a uniform requirement for both 
components and industry employees to report: (1) all 
contacts with foreign nationals who request classified 
or unclassified defense information, or which suggest a 
possible effort at recruitment; and (2) all official and 
unofficial contacts with foreign nationals of any coun- 
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terests inimical to those of the United States. Reports 
should be made to commanders or supervisors who will 
determine whether referral to investigative agencies is 
warranted. 

42. Direct DoD components and cleared contractors 
to establish appropriate internal procedures requiring 
cleared employees to report to their security office all 
personal foreign travel in advance. Records on such 
travel should be maintained by the office concerned for 
the last five years. Where travel patterns indicate the 
need for investigation, the matter will be referred to 
the appropriate counterintelligence investigative agen- 
cy. While it is recognized that persons actually engag- 
ed in espionage are unlikely to report such travel, a 
failure to observe this requirement, if detected, could 
itself suggest the need for further investigation. 

43. Authorize the use of passive sources in sensitive, 
classified projects and programs to watch for and 
report indicators of possible espionage activities among 
cleared persons to appropriate authorities. 


Detecting and Investigating 
Security Violations 


DoD policy requires that security violations (i.e., 
instances where classified information was, or may have 
been, compromised) be reported and investigated. 
Relatively little effort, however, is dedicated by DoD 
components to detecting such violations through unan- 
nounced inspections or searches, neither of which is made 
mandatory by DoD policy and procedure. 

Moreover, where security violations are apparent, 
they are frequently not reported or investigated, and even 
less frequently are they referred to professional in- 
vestigative agencies, even where a pattern of such viola- 
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ty violations which appear to be attributable to 
negligence, misunderstanding, or “exigencies of the situa- 
tion” can, in fact, be indications of a serious security prob- 
lem. 


¢ RECOMMENDATIONS: 


© 44, Establish a policy that all persons entering or leav- 
ing defense activities, including, to the extent prac- 
tical, its contractors, are subject to inspection of their 
briefcases and personal effects, to determine if 
classified material is being removed without authority. 
DoD components should then establish internal pro- 
cedures to require some type of inspection program be 
instituted at the facilities under their control, recogniz- 
ing the need not to affect unduly the flow of traffic to 
and from DoD installations and to respect the personal 
privacy of employees. DoD components should also 
establish appropriate internal procedures requiring 
unannounced security inspections to be made of ac- 
tivities where classified work is performed. 
45. Require reports to appropriate counterintelligence 
and investigative authorities concerning any employee 
who is known to have been responsible for repeated 
security violations over a period of one year, for ap- 
propriate evaluation. 


Taking Effective Action Against 
those who Violate the Rules 


In order to maximize compliance with the security 
standards and deter violations, commanders, supervisors, 
and contractors must effectively employ available 
criminal, civil, and administrative sanctions against those 
who engage in espionage, commit security violations, or 
otherwise compromise classified information. Effective 
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sanctions as well as the willingness of supervisors to im- 
pose them. 

Crimes by service members. The FY 1986 Defense 
Authorization Act amends the Uniform Code of Military 
Justice (UCMJ) to establish a peacetime military es- 
pionage offense and provides capital punishment for both 
peacetime and wartime offenses. 

With these changes, adequate criminal and ad- 
ministrative remedies will be available to punish a broad 
spectrum of violations of security rules by military per- 
sonnel, including the unauthorized disclosure of classified 
information. The sanctions range from capital punish- 
ment for espionage to prison terms for less serious crimes 
to nonjudicial punishment for minor violations. 

Crimes by civilian personnel. Civilian criminal 
statutes relating to espionage and unauthorized disclosure 
of classified information do not provide adequate 
remedies. For several years the Department has sup- 
ported, in principle, proposed legislation to establish 
more effective criminal sanctions against unauthorized 
disclosure of classified information, but agreement within 
the government with respect to the content of such a pro- 
posal has not been achieved. 

Other recent developments, however, may result 
in more effective criminal enforcement against civilian of- 
fenders. The first such development is the reinstitution of 
the death penalty for civilian espionage. A bill for this 
purpose (S.239) has passed the Senate but not the House. 
Enactment of S.239 would significantly increase the 
deterrent effect of existing civilian espionage statutes. 

Since 1975, the Department of Justice has 
vigorously pursued enforcement of the espionage laws 
and related statutes. An example of this was the recent 
trial of Samuel Loring Morison, in which the trial judge 
ruled that the civilian espionage laws can be used to pros- 
ecute the unauthorized disclosure of classified informa- 
tion without proof of a specific intent to injure the U.S. or 
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victed. If the conviction is upheld, it will provide addi- 
tional precedent for the legal principle that deliberate 
unauthorized disclosure of classified information con- 
stitutes a crime under the espionage statute. Never- 
theless, the precedent of the Morison case will not enable 
the espionage laws to be used to punish unauthorized 
disclosure of classified information under all cir- 
cumstances. 

The courts have also allowed defendants to be 
charged with other types of crimes (such as theft of 
government property and conversion of proprietary infor- 
mation) in cases where classified information has been 
improperly obtained but where espionage is not an ap- 
propriate charge. This is illustrated by a recent prosecu- 
tion for theft of classified DoD budget documents to 
enhance a contractor’s competitive position. 

Civil remedies against civilian offenders. In those cases 
where the criminal sanctions agains civilian offenders are 
inadequate, civil remedies may provide effective enforce- 
ment tools. For example, a suit against the offender for 
money damages may be possible under certain condi- 
tions; or action to recover documents from possession of 
an unauthorized person may also be undertaken. 

Administrative measures regarding DoD personnel. 
Military and civilian employees of the Department who 
violate security regulations are subject to a range of ad- 
ministrative actions (in addition to the criminal and civil 
sanctions mentioned above), to include warning, repri- 
mand, suspension without pay, forfeiture of pay, 
removal, and discharge. Executive Order 12356, which 
establishes the security classification system, provides that 
appropriate sanctions will be administered to those who 
violate the order. 

It is improper to impose suspension or termination 
of a security clearance as a penalty for security violations. 
Nevertheless, adjudicative authorities should be _per- 
mitted to suspend a security clearance in cases where an 
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inability to protect classified information, pending the 
readjudication of the clearance. 

Administrative measures regarding contractors and thew 
employees. ‘The responsibility for taking administrative ac- 
tion against offending contractor employees lies with the 
contractor. DoD has no legal basis to force the contractor 
to take such action. In the absence of such actions by the 
contractors, DoD’s only administrative recourse with 
respect to an offending contractor employee is to seek 
revocation of the individual's security clearance. Contrac- 
tors should be required, therefore, to establish and 
vigorously enforce company sanctions consistent with 
DoD policy. 

With respect to the company itself, DoD may 
withhold payments under DoD contracts from contrac- 
tors who fail to comply with the terms of the contract, in- 
cluding security requirements. Although this remedy has 
not heretofore been utilized in security cases, it 1s poten- 
tially a powerful one. 

DoD can also revoke the contractor’s facility 
clearance based upon failure to correct serious security 
deficiencies. However, since most companies take some 
type of corrective action, revocation of the facility 
clearance rarely occurs, even though the company may be 
cited for repeated serious violations. 


RECOMMENDATIONS: 


46. Continue to advocate enactment of legislation to 
enhance criminal enforcement remedies against 
civilians who improperly disclose classified informa- 
tion. 

47. Instruct commanders and supervisors, in con- 
sultation with appropriate legal counsel, to utilize all 
appropriate enforcement remedies—criminal, civil, 
and administrative—against employees who violate 
the law and security regulations. 
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quire supervisors and commanders to refer to ap- 
propriate adjudicative authorities the security 
clearance of any person who: 

a. Deliberately disclosed classified information to an 
unauthorized person; or 

b. Committed two security violations within a year, 
one of which resulted in loss or compromise of 
classified information. 

Provide further that adjudicative authorities may 
suspend such clearance when it appears that other 
classified information would be jeopardized by con- 
tinued access of the individual, pending investigation 
and final adjudication of the clearance. 

49. Require defense contractors to establish and en- 
force company policies which provide for appropriate 
administrative actions against employees who violate 
security regulations. 

50. Make broader use of the authority under DoD 
procurement regulations to withhold payments under 
a classified contract in order to enforce compliance 
with DoD security requirements. 

91. Permit revocation of a contractor’s facility 
clearance for repeated security violations of a serious 
nature or other conduct which demonstrates a serious 
lack of security responsibility, regardless of whether ac- 
tions have been taken to correct specific deficiencies for 
which the company had previously been cited. 
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Management and 
Execution 


In addition to reviewing policy and procedure, the 
Commission addressed shortcomings in the management 
and administration of counterintelligence and security 
programs. Policy and procedure are only as effective as 
the manner in which they are carried out. Indeed, in 
terms of the entire process, policy formulation — while the 
indispensable beginning—constitutes only a minute part 
of the task to be accomplished; the great effort—and 
challenge—is in the implementation and execution. 

In general, the Commission found DoD 
counterintelligence and security programs to be ade- 
quately managed by most DoD components. Never- 
theless, it discerned major gaps between policy and prac- 
tice where improvements were urgently needed. 


Commander/Supervisor 
Emphasis 


Commanders and supervisors, from the highest 
leadership of the Department down to field commanders 
and officers of small defense contractors, play the key 
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not only issuing orders and instructions, but setting an 
example as well. Subordinates tend to observe security 
rules and regulations the way they perceive their com- 
mander or supervisor treats them. While it is impossible 
to measure precisely this intangible but crucial factor, the 
Department’s overall performance in this regard must be 
considered uneven at best. 

Directives clearly tell commanders and _ super- 
visors what information should be classified and when it 
should be downgraded; still, overclassification remains a 
problem and declassification actions are rare. Directives 
explicitly prohibit the passing of classified information to 
those lacking a clearance and a specific need-to-know; 
yet, all too often, classified information is discussed 
without ascertaining the level of clearance of the persons 
who are listening, much less determining their “need-to- 
know”. Regulations provide that classified information 
cannot be taken home to work with, unless stored in an 
approved safe, but the prohibition is ignored by many for 
the sake of convenience. Regulations restrict the 
reproduction of classified material; yet, files bulge with 
unauthorized and often needless copies. By simply carry- 
ing out extant policy, commanders and supervisors can 
substantially improve the quality of security in the 
Department. Yet, some commanders and supervisors 
show a clear disdain for security, leaving compliance to 
clerks and secretaries. When security requirements 
become an impediment, they are ignored either for 
reasons of personal convenience, to facilitate job perform- 
ance, or, perhaps, for political reasons. Whatever the 
reason, such attitudes have a debilitating impact on 
subordinates and on the success of the program as a 
whole. It is difficult for the cleared rank-and-file to take 
the system seriously when their commander or supervisor 
himself does not comply with the rules. 
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e RECOMMENDATION: 


© 52. The Secretary of Defense should direct all DoD 
components which handle and store classified informa- 
tion to institute one-time “top-to-bottom” command in- 
spections at every level of their organizations within six 
months. Such inspections should, at a minumum, 
ascertain: (1) if applicable DoD and component securi- 
ty policies are understood by commanders and super- 
visors, as well as subordinates; (2) if such policies are, 
in fact, being complied with; and (3) if they are being 
enforced. Results of these command inspections should 
be reported to the next higher level of authority, with 
DoD components ultimately submitting consolidated 
reports to the Secretary of Defense within nine 
months. DoD components should also ensure that 
recurring inspections are made by their Inspectors 
General or equivalents in compliance with applicable 
security policies throughout the department or agency 
concerned. 


Organizational 
Arrangements 


The Commission did not consider indepth 
organizational arrangements below the DoD level. It is 
apparent, however, that the organizations and offices in- 
volved in security policy development and oversight, as 
well as in security administration, constitute a substantial 
bureaucracy within DoD. Security policy functions are 
fragmented in most DoD components. Few have con- 
solidated all aspects of security policy under one official. 
Moreover, security officers are often “buried” far down in 
the organization and consequently have neither the 
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recommendations to top management attention nor the 
authority to conduct effective oversight and deal with 
deficiencies. Security administration (as opposed to 
security policy development) is necessarily decentralized, 
reaching down to the office level. All too often, however, 
there are no organizational links between security policy 
offices and security administrators, reducing mutual ex- 
change between them. 

With respect to DoD-level organizational ar- 
rangements, security policy development within the OSD 
staff is split between the Deputy Under Secretary of 
Defense for Policy (DUSD(P)) and the Assistant 
Secretary of Defense for Command, Control, Com- 
munications, and Intelligence (ASD(C3I)). These offices 
share oversight responsibility with the DoD Inspector 
General and the DoD General Counsel. Within 
DUSD(P), the Directorate for Counterintelligence and 
Security Policy, staffed by 25 professionals, has primary 
staff responsibility for policy development and oversight 
of the areas of: information security; personnel security; 
physical security; industrial security; Special Access Pro- 
grams; disclosure of classified information to foreign 
governments; management of the Foreign Disclosure and 
Technical Information (FORDTIS) system; operations 
security; and counterintelligence operations, investiga- 
tions, and production. 

As a result of a recent OSD staff reorganization, 
responsibility for policy development and oversight in the 
areas of communications security and automated infor- 
mation systems security was transferred to the Deputy 
Assistant Secretary of Defense for Command, Control 
and Communications (DASD(C3)), staffed in these areas 
by four professionals. Presumably, this decision was 
motivated, in part, by the designation of the ASD(C3J) as 
Chairman, of the National Telecommunication and In- 
formation Systems Security Committee (NTISSC), 
which formulates national policy in these areas from 
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It is clear, however, that all DoD security 
disciplines have as one fundamental purpose the protec- 
tion of classified information and must be applied in a 
fully balanced and coordinated way. Actions taken in one 
area, (e.g., personnel security), have a direct bearing 
upon actions taken in other areas (e.g., automated 
systems security). Where security policy functions are 
fragmented, the chances of reaching inconsistent and 
wasteful results are increased. Pertinently, the Depart- 
ments of State and Energy have recently seen fit to 
establish consolidated professional security organizations 
at the Assistant Secretary and Deputy Assistant Secretary 
level, respectively. 

While there are numerous interdepartmental 
boards and committees in the area of counterintelligence 
and security established by DoD issuances, there is no 
high-level advisory board which covers the entire security 
area with a direct reporting channel to the Secretary of 
Defense. Recommendations for changes to existing policy 
and procedure are thus moved through normal staff chan- 
nels from DUSD(P) or ASD (C3J) to the Secretary. 

A number of functions vital to the success of the 
DoD security program which logically should be per- 
formed at DoD level are not being accomplished for lack 
of sufficient OSD staff. Indeed, the staff of the Secretary 
of Defense for security policy development and oversight 
is substantially undermanned. One or two professional 
staff members are typically assigned responsibility for 
huge DoD programs, e.g., two each for personnel securi- 
ty and industrial security; one each for Special Access 
Programs and use of the polygraph. Most stay fully oc- 
cupied handling incoming actions; there is little time for 
policy development or oversight, theoretically their prin- 
cipal functions. 

For example, neither DUSD(P) nor ASD(C3I) 
coordinates research and development activities in the 
security area. A single action officer located in the Office 
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Engineering) coordinates research limited to physical 
security hardware. In general, the Military Departments 
and, occasionally, defense agencies initiate such work on 
their own without DoD-wide evaluation or application. 
The scope of this research effort is far too narrow (see the 
discussion of “Research” below). 

A second area with virtually no staff involvement 
is the collection of statistical data needed for management 
purposes. The Commission was struck by the lack of 
statistical data available upon which management deci- 
sions concerning a number of critical counterintelligence 
and security programs should logically be based. 

A third area where there is no OSD involvement is 
the coordination of security training activities. The result 
is that there are numerous gaps and much redundancy in 
the existing system (see the discussion of “Training” 
below). Relatedly, in the area of security awareness, there 
is no OSD oversight to ensure that DoD programs 
achieve overall coverage or that they are supported by 
high-caliber briefings and audiovisual aids. 

There is also very little OSD involvement in im- 
proving career development patterns for personnel with 
responsibilities in the security area. The DoD com- 
ponents are left to establish and structure their own pro- 
grams, with mixed results. (See the discussion of “Career 
Development” below.) 

Finally, there is no central clearinghouse for infor- 
mation and publications in the security area. No office is 
charged with the systematic collection and distribution of 
reports or research. Work done by one component gets to 
OSD or to other DoD components who may have a use 
for it only by happenstance. The system would benefit if a 
clearinghouse program were in effect. 

The functions set forth above are crucial to the 
overall security program. The discharge thereof will re- 
quire personnel resources not now available to the OSD 
staffs concerned. Those functions involving policy direc- 
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DUSD(P)—can be accommodated by modest staff 
augmentation. Discharge of the other functions will re- 
quire more personnel resources and need not, in any case, 
be placed on the OSD staff. In the Commission’s view, 
the most practical solution would be to assign these 
responsibilities to an expanded Defense Security Institute 
(DSI). That Institute is now part of DIS and its mission is 
limited to training DoD personnel and contractors in 
various aspects of security, as well as publishing security 
awareness materials for industry. Under the Commis- 
sion’s concept, the Defense Security Institute would re- 
main assigned to DIS but would be responsive to the 
policy direction of the DUSD(P). 


e RECOMMENDATIONS: 


o 53. The Secretary of Defense should re-examine ex- 
tant OSD staff functions in light of the desirability of 


placing related security policy responsibilities in a 
single staff element. 

54, Unless countervailing management considerations 
obtain, the senior official(s) responsible for counter- 
intelligence and security policy matters within OSD 
and DoD components should have a direct reporting 
channel to the head of the department or agency. 


55. The Secretary should establish a Security Advisory 
Board to advise him periodically with respect to the 
security posture of the DoD. 


56. The Secretary should authorize modest augmenta- 
tion of the OSD staff to insure effective policy direction 
and oversight. 


57. The Secretary should designate the Defense 
Security Institute as the principal support activity for 
DoD security programs; authorize its expansion; and 
place AppitdvediormRelease t2006)0231K PC IAxRPHY6B0 1 172R000100090004-35 


direction. 
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Research 


Although billions of dollars are spent annually for 
security, relatively little goes to research activities. 
Moreover, significant aspects of policy and practice which 
should properly be based upon research. Yet, such 
research is neither ongoing nor planned. 

For example, there logically should be research to 
determine the optimum structure of background in- 
vestigations. There should also be an analysis of the ef- 
ficacy of the information elicited on personal history 
statements required to be filled out by clearance ap- 
plicants; and there should be a similar analytic basis 
underpinning questions being asked of the subject by DIS 
investigators. None of this exists. 

There should also be research into the efficacy of 
new techniques to supplement background investigations, 
such as psychological and behavioral tests (e.g., to deter- 
mine such characteristics as compulsion to seek or reveal 
information received in confidence) and urinalysis, but, 
with the exception of work begun on the use of 
psychological tests, little has been accomplished in this 
area, 

Research on the reliability and validity of the 
polygraph is also minimal. Although the NSA has ini- 
tiated a promising new effort in the past year, the topic 
urgently warrants additional work. 

Adjudication policies also beg for a firmer basis in 
research. DoD guidelines for denying security clearances 
should logically be based upon a credible analysis which 
demonstrates a logical link between the grounds used for 
denying a security clearance (e.g., excessive use of 
alcohol) and the likelihood that such behavior may 
reasonably be expected to lead to a compromise of 
classified information. SBOTaaRD there is insufficient 
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There has been some improvement with respect to 
research on physical security devices and equipment. 
Under the direction of the Under Secretary of Defense 
(Research and Engineering), the Army, Navy, and Air 
Force are developing such devices as internal detection 
sensors, external sensors, and emergency destruction 
systems. Moreover, DoD has participated in interagency 
efforts which have led to improvements in secure storage 
containers and automated access devices. 

There is, however, a paucity of research ac- 
complished or contemplated within DoD with respect to 
devices or procedures which could detect or prevent the 
unauthorized removal of classified information from DoD 
or contractor installations or which could prevent or 
detect the unauthorized reproduction of classified infor- 
mation. In view of the technological advances in recent 
years, it would appear that such devices or procedures are 
well within the technical capabilities of modern industry. 

With regard to information security, almost no 
research is available, ongoing or contemplated. And yet, 
research into how the classification system actually works 
in practice (e.g., how much improper classification is 
there? how much classified information is created? how 
much is destroyed?) would provide a clearer basis than 
presently exists to manage the system. 

Only in communications security equipment and 
automated information systems security, both of which 
are managed by the NSA, did the Commission find well- 
defined research programs in being. 

The deplorable state of: research in the area of 
security can be attributed primarily to the fact that no one 
office is specifically charged with responsibility for coor- 
dinating and promoting all such activities. While clearly 
such activities would have to compete with other DoD 
research priorities, funds have not, for the most part, 
been requested or programmed for these activities by any 
office or component. DUSD(P) agrees that such respon- 
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cient staff to coordinate and monitor research contracts or 
component activities in this area. 


e RECOMMENDATION: 


oO 58. Authorize substantially increased funding for 
security research to be coordinated through the DoD 
focal point (See Recommendation 57 above), to in- 
stitute research at the earliest possible date into: (a) 
determining the efficacy of the elements of background 
investigations, including information required on per- 
sonal history statements and in subject interviews; (b) 
the feasibility of the subject providing additional infor- 
mation to establish bona fides; (c) new techniques to 
supplement the background investigation such as 
psychological, behavioral tests (e.g., to measure com- 
pulsion to talk, to divulge or acquire information or the 
propensity for carelessness or to explain away prob- 
lems), and urinalysis; (d) polygraph reliability; (e) the 
development of more precise adjudicative standards 
based upon conduct which is reasonably likely to result 
in compromise of classified information; (f) devices and 
equipment which could prevent or detect the 
unauthorized removal or reproduction of classified in- 
formation; (h) how the classification system actually 
works in practice; and (i) physical security technology. 
The results of all such research efforts should be widely 
shared within the Department and its contractors. 


Training 


Security training, like other professional dis- 
ciplines, has a direct bearing upon the quality of perform- 
ance. DoD has certain specific training requirements, 
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security training, particularly in non- 
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technical areas, are left to the discretion of DoD com- 
ponents. DoD requires no minimal level of training, for 
example, for civilian or military employees who perform 
security duties. In industry, contractors are encouraged 
to avail themselves of training courses provided at the 
Defense Security Institute, but attendance is not man- 
datory. As a practical matter, larger contractors with 
security staffs usually send representatives to these 
courses, while smaller contractors do not. The great ma- 
jority of industrial employees who perform security duties 
receive no formal security training. 

As stated earlier, there is no formal training, apart 
from occasional seminars, given to persons who must ad- 
judicate security clearances. There exists a clear need to 
instruct such personnel in the application of DoD ad- 
judication criteria to particular and recurring fact situa- 
tions to ensure greater consistency of results. 


¢ RECOMMENDATIONS: 


© 59. Establish minimal levels of required training for 
DoD military and civilian personnel who perform 
security duties. Task the Defense Security Institute 
and National Security Agency, as appropriate, to 
develop and provide basic courses of instruction for 
such personnel, supplemented as necessary by compo- 
nent courses of instruction. A course of instruction on 
adjudication of security clearances should be 
developed by DSI in coordination with the DoD 
General Counsel, and made mandatory for all DoD 
personnel assigned adjudication functions. 


60. Require all DoD contractor security officers, or 
those otherwise performing security duties for a 
cleared contractor, to complete some type of uniform 
training. This could take the form of a required cor- 
respondence course administered by the Defense 
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security course is not feasible. 


© 61. All training in the security area should result in 
appropriate certifications by DoD (e.g., as a security 
specialist, adjudicator, industrial security specialist) to 
be recorded in the personnel file of the individual. 


Career Development 


Security professionals seek other careers when 
they cannot envision a clear path to higher positions of 
rank and responsibility; when untrained and unqualified 
persons are placed into positions which should be oc- 
cupied by security professionals; and when they are 
qualified for advertised positions but are hampered by be- 
ing classified under a job series which is too restricted. 
Unfortunately, in some DoD components, such condi- 
tions are already in evidence. 

In part, this can be attributed to the fact that no 
DoD office is specifically charged with responsibility for 
career development of security professionals. Conse- 
quently, very little has been done in DoD as a whole to 
improve the career outlook for security specialists over the 
long-term. The Commission believes that this area merits 
serious attention and should be charged to an expanded 
Defense Security Institute (see Recommendation 57). 

The OPM Job Classification Standard for Securi- 
ty (GS-080) is seriously out-of-date and does not accurate- 
ly or completely describe the elements which currently 
need to be included to cover today’s civilian security 
specialists (and their military equivalents). Moreover, 
current DoD and OPM standards do not require that 
security staff and leadership positions be filled by 
qualified security professionals. This permits situations 
that are demoralizing to security professionals. 
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¢ RECOMMENDATION: 


© 62. The Secretary of Defense should request OPM to 
revise immediately the Classification Standard for 
Security (GS-080), to include comprehensive and ac- 
curately graded descriptions of all modern security 
disciplines integral to DoD security programs. 


Program Oversight 


Without continuing program oversight, there can 
be no assurance that policy is being translated into prac- 
tice in the field. Within most DoD components, oversight 
mechanisms are in place, although their scope and effec- 
tiveness vary widely. At the top of the DoD security struc- 
ture, however, program oversight is poor. While the 
Commission was unanimously agreed that program over- 
sight was appropriately a function of the OSD staff, very 
little oversight is being performed at that level due to lack 
of sufficient staff. For example, OSD staff rarely conducts 
component headquarters inspections, much less examines 
compliance of field elements with DoD security policy. 
Similarly, in some components, shortfalls in staff often 
result in partial or incomplete implementation of DoD 
security policy at the operating activity level. 

In industry, 225 DoD industrial security repre- 
sentatives are inspecting on a periodic basis 13,000 
cleared defense contractors to ensure compliance with in- 
dustrial security requirements. Although the time spent 
by these inspectors at each cleared facility varies with the 
volume and level of cleared information possessed, as a 
practical matter, their inspections are necessarily cir- 
cumscribed. The Commission concludes that this func- 
tion is seriously understaffed. 
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Resource Management 


The Commission did not delve in detail into the 
resource management aspects of the DoD security pro- 
gram, since it considered the subject tangential to its 
primary task. However, even on the basis of cursory ex- 
amination, several conclusions are evident. 

Some elements of counterintelligence and security 
ar managed as separate programs or separate line items in 
programs (e.g., foreign counterintelligence, background 
investigations, COMSEC); but counterintelligence and 
security is not “resource-managed” as an entity. Indeed, 
there appears no useful purpose served by attempting to 
do so. Many security expenditures are so deeply em- 
bedded in other budgets/programs (e.g., physical securi- 
ty, operation security) that attempting to isolate them 
would be a time-consuming and ultimately unrewarding 
exercise. 

On the other hand, it may be prudent for DoD 
components to select for program management certain 
security elements which are not now programmed or 
budgeted as discrete line items but which involve large 
dollar expenditures. The objective would be to determine 
how resources are being spent and whether such expen- 
ditures are justified by the threat. The extent to which 
equipment is being shielded to prevent unintended emis- 
sions (TEMPEST) would appear to be a logical candidate 
since the costs of the requirement are estimated to run in- 
to the hundreds of millions of dollars annually. While 
TEMPEST protection may be essential in some overseas 
areas, the environment within the United States is 
dramatically different. Consequently, the once rigid 
TEMPEST policy was modified two years ago to 
prescribe shielding only when inspection verified that a 
threat existed. Yet, while the policy has changed, there is 
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Relatedly, there is no office in OSD which is 
charged with making assessments of the overall efficacy of 
the DoD security system and the relative balance among 
its several components. No office looks at counter- 
intelligence and security resource expenditures as a whole 
(even those that are separately managed), or which looks 
at them in terms of the relative proportions of expen- 
ditures dedicated to the various security disciplines (e.g., 
how much is being spent on background investigations of 
personnel with access to automated information systems 
versus how much is being spent on the technical protec- 
tion of such systems). The lack of this kind of evaluation 
could lead to funding levels being greatly dispropor- 
tionate, in terms of their relative contribution to the 
overall DoD security program. 
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Resource Impact 


Implementation of the Commission’s recommen- 
dations would have widely differing resource implica- 
tions: 

Some could lead to substantial cost avoidance. 
Some could result in net savings. 

Some could require substantial added expen- 
ditures. 

Some could be simply inconvenient without 
representing added costs. 


Overall, there is a price tag. The totality of 
enhancements recommended by the Commission will re- 
quire more manpower and dollars than now allocated to 
security programs. Considering, however, overall defense 
expenditures as well as the monetary costs of successful 
espionage, these additional expenditures must be re- 
garded as modest. 

Precise estimates of net costs are not possible, 
since it is impossible to quantify the impact of either those 
recommendations which should save money, or those 
which will require it. In the area of personnel investiga- 
tions, for example, Recommendations 1-5 should logical- 
ly result in fewer background investigations (and 
reinvestigations) being requested, although the 
magnitude of such reductions remains to be determined. 
In addition, it stands to reason that implementation of 
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for interim SECRET clearances to the processing of all 
such clearances) should mean considerable savings to the 
Department overall, eliminating production delays while 
employees and contractors are waiting for security 
clearances. 

On the other hand, Recommendations 8, 9, and 
14 call for significantly more investigations than are now 
being conducted (e.g., an expanded investigative scope 
for SECRET and higher numbers of investigations). It is 
clear that, with respect to DIS, substantially more 
resources will be required than are now programmed. 

The bulk of additional funds will be required for 
production of communications security equipment and 
research in automated information systems security. 
More modest amounts would be required for other 
categories of research, training, oversight, and the ad- 
ministrative costs associated with some of the Commis- 
sion’s recommendations (e.g., establishing a TOP 
SECRET billet system, PRP-type reliability programs, 
accounting for SECRET materials, and supervisory ap- 
praisals). 

In large part, these additional costs would be offset 
if DoD components would simply comply with the policy 
changes described above with respect to the purchase of 
“TEMPEST-approved” electronic equipment for use 
within the United States. Many defense contractors told 
the Commission that DoD components are continuing to 
require them to purchase shielded equipment, not- 
withstanding the recent policy change, at substantially 
higher costs than unshielded equipment. DoD com- 
ponents could also be reducing their own procurement 
costs substantially by complying with the stated policy. 

In any case, it is clear that, for those recommenda- 
tions which are approved and have budgetary impacts, 
DoD components must begin to program and budget the 
enhancements needed to implement them. This process 
should begin upon approval by the Secretary. 
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¢ RECOMMENDATION: 


© 63. Recommendations of the Commission which re- 
quire resource enhancements should be accom- 
modated, as appropriate, either by reprogramming in 
FY 1986 or FY 1987, incorporation in the Program 
Objectives Memoranda for FY 1988, or in the current 
Defense Guidance. 
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Conclusion 


While no system of security can provide foolproof 
protection against espionage, it can make espionage more 
difficult to undertake and more difficult to accomplish 
without detection. In this respect, DoD’s current security 
program falls short of providing as much assurance as it 
might that the nation’s defense secrets are protected. 

The Commission believes that increased priority 
must be accorded DoD security efforts. More resources 
should be allocated to security, even at the expense of 
other DoD programs. New safeguards must be added, 
and many old ones improved, even at a cost to opera- 
tional efficiency. This is not to say that some resources 
cannot be saved or operational efficiency enhanced by 
eliminating burdensome and unproductive security re- 
quirements. Indeed, a number of such changes are 
recommended by the Commission. But, on the whole, 
DoD must be willing to pay a higher price, in terms of 
both resources and operational convenience, to protect its 
classified information. 

The Commission arrives at this conclusion mind- 
ful that security plays only a supporting role in the suc- 
cessful accomplishment of DoD’s operational mission. 
But the success of any classified project or operation must 
be judged short-lived at best if, at the same time, the 
results have been revealed to potential adversaries, who 
are enabled to develop countermeasures at a more rapid 


pace than otherwise. As bureaucratic and mundane as 9 
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security sometime appears, it offers the only systematic 
means available to protect and preserve the defense com- 
munity’s triumphs and advances over time. Security must 
be given its fair share of serious attention and its fair share 
of resources. 
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“it is the responsibility of each in- 
dividual, who has been entrusted 
with sensitive data, to do his or her 
share in protecting America’s 
strategic knowledge. If Americans 
do not conduct themselves in a 
responsible manner, or do not 
recognize that this country’s na- 
tional security is based upon the 
loyalty and efforts of its citizens, 
then the tightest document classiti- 
cation system, the most efficient 
security organizations, and the 
strongést armed forces may be 
completely ineffective in protecting 
its citizens from “all enemies, 
foreign and comestic.”’ 


FEDERAL BUREAU OF 
INVESTIGATION 
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Appendix A: Persons Who | 
Testified Before the Commission 


Robert Allen 


Maynard Anderson 
STAT 


Allen Becker 
Arthur E. Brown, Lieutenant General, 
U.S. Army 


Americo R. Cinquegrana 


Donald Doll 


John F. Donnelly 


Richard E. Elster 


Director, Navy Security Policy 


Director, Security Plans and Programs, 


ODUSD(P) 


Research Security Coordinator, 
Georgia Institute of Technology 


Director of the Army Staff 


Deputy Counsel for 
Intelligence Policy, Office of 
Intelligence Policy and Review, 
Department of Justice 


Chairman of the Industrial Security 
Committee, Aerospace Industries 
Association of America 


Director, Counterintelligence and 
Investigative Programs, ODUSD(P) 


Deputy Assistant Secretary of the 
Navy (Manpower) 
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Andrew Feinstein 


Eh S. Flyer 


Daniel R. Foley 


Steven Garfinkel 


Joseph S. Greene, Colonel, US 
Air Force 


John Hancock 


Theodore G. Hess, Lieutenant 
Colonel, U.S. Marine Corps 


Eleanore Hill 


Chief Counsel and Staff Director, 
Subcommittee on Civil Service, 
Committee on Post Office and Civil 
Service, U.S. House of 
Representatives STAT 


Consultant to the 
Counterintelligence and 
Investigative Programs 
Directorate, ODUSD(P) 


Deputy Assistant Inspector 
General for Investigations, DoD 


Director, Information Security 


Oversight Office 


Deputy Director, National 
Computer Security Center 


Chief, Programs Management 
and Physical and Information 
Security Division, Defense 
Investigative Service 


Special Assistant for 
Intelligence, OASD 
(Legislative Affairs) 


Minority Counsel, Senate 
Permanent Subcommittee on 
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Stanislav Levchenko 


Guenther Lewy 


John L. Martin 


STAT 


[ 


Daniel Nauer 
Thomas J. O’Brien 


Phillip A. Parker 
George Paseur 


David R. Patterson, Captain, U.S. 
Navy 


[| 


Chairman, DCI Security 


Committee 
Soviet KGB Defector 


Professor of Political Science, 
University of Massachusetts 


Chief, Internal Security 
Section, Criminal Division, 
Department of Justice 


Deputy Director of Security, 
Central Intelligence Agency 


Aerospace Industries 
Association of America 


Director, Defense 
Investigative Service 


Deputy Assistant Director 
of the Intelligence Division, Federal 
Bureau of Investigation 


Director, Information Security, 
Office of Security Police, 
Headquarters, U.S. Air Force 


Chief, COMSEC Policy 
and Threat Analyses, National 
Security Agency 


Director of Security, 
National Security Agency 
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John H. Shenefield 


L. Britt Snider 


William O. Studeman, Commodore, 
U.S. Navy 

Francis X. Taylor, Lieutenant 
Colonel, U.S. Air Force 


James A. Williams, Lieutenant 


General, U.S. Army 


Member of the American 
Bar Association Standing 
Committee on Law and 
National Security 


Principal Director, 
Counterintelligence and 
Security Policy, ODUSD(P) 


Director of Naval Intelligence 


Deputy Director for Operations, 
Counterintelligence and 
Investigative Programs 
Directorate, ODUSD(P) 


Director, Defense Intelligence Agency 
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Appendix B: Senior Industry 
Officials Interviewed by the 
Commission 


William H. Borten 
President and Chief Operating Officer 
Atlantic Research Corporation 


Norman C. Witbeck 
President 
Columbia Research Corporation 


Joseph V. Charyk : 
Chairman and Chief Executive Officer 
COMSAT (Communications Satellite Corporation) 


John W. Dixon 
Chairman and Chief Executive Officer 
E-Systems, Inc. 


H. Ross Perot 
Chairman 
Electronic Data Systems Corporation 


Vince Cook 

President 

International Business Machines 
Federal Systems Division 


Frank J. Lewis 


Senior Vice President 
Harris Corporation 
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Robert Kirk 
President and Chief Executive Officer 
LTV Aerospace and Defense Company 


Franc Wertheimer 
President 
ManTech International Corporation 


Thomas G. Pownall 
Chairman and Chief Executive Officer 
Martin Marietta Corporation 


Sanford McDonnell 
Chairman 
McDonnell Douglas Corporation 


Thomas V. Jones 
Chairman of the Board and Chief Executive Officer 
Northrop 


Wayne V. Shelton 
President and Chief Operating Officer 
Planning Research Corporation 


Frederick F. Jenny 
President and Chief Executive Officer 
System Development Corporation 


Ronald L. Easley 
President and Chief Executive Officer 
System Planning Corporation 


Jerry R. Junkins 


President 
Texas Instruments Incorporated 
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Appendix C: Senior Industry 
Officials Who Provided 
Written Comments to the 
Commission 


Jack L. Heckel 
Chairman 
Aerojet General 


T. A. Wilson 
Chairman of the Board 
The Boeing Company 


J. A. Pikulas 
Director, Administrative Services 
Chrysler Corporation 


J. J. Bussolini 
Vice President 
Grumman Aerospace Corporation 


Carl D. Thorne 

Vice President 

Finance and Administration 
Computer Sciences Corporation 


Charles M. Williams 
President 

EG&G Washington Analytical 
Services Center, Inc. 


Emanuel Fthenakis 
President 
Fairchild Industries, Inc. 
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N. R. Duff 

Vice President 

Industrial Relations Staff 

Ford Aerospace & Communications 
Corporation 


O. C. Boileau 
President 
General Dynamics Corporation 


E. E. Hood, Jr. 
Vice Chairman of the Board 
General Electric 


Boyd T. Jones 
President 


Control Data Corporation 


John A. Young 


President and Chief Executive Officer 


Hewlett-Packard Company 


Warde F. Wheaton 
Executive Vice President 
Aerospace and Defense 
Honeywell 
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Allen E. Puckett 

Chairman of the Board and 
Chief Executive Officer 
Hughes Aircraft Company 


William G. McGowan 
Chairman of the Board and 
Chief Executive Officer 


MCI Communications Corporation 


Thomas L. Phillips 
Chairman 
Raytheon Company 


Donald R. Beall 
President and Chief 
Operating Officer 
Rockwell International Corporation 


Jack L. Bowers 


Chairman and Chief Executive Officer 


Sanders Associates, Inc. 


Lawrence J. Howe, CPP 

Vice President 

Corporate Security 

Science Applications International 
Corporation 


J. J. Yglesias 
Chairman and Chief Executive Officer 
SYSCON Corporation 


John W. Pauly 
Chief Executive Officer 
Systems Control Technology, Inc. 


Robert C. Gormley 
President 
Vitro Corporation 


J. B. Toomey 
President 
VSE Corporation 


Douglas D. Danforth 
Chairman 
Westinghouse Electric Corporation 
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Appendix D 


THE SECRETARY OF DEFENSE 


WASHINGTON, THE DISTRICT OF COLUMBIA 


28 AUG 1985 


MEMORANDUM FOR THE UNDER SECRETARY OF DEFENSE (POLICY) 
ASSISTANT SECRETARY OF DEFENSE (FORCE 
MANAGE MENT AND PERSONNEL) 


SUBJECT: Security Evaluation of DoD Personnel with Access to 
Classified Information 


The proper handling and protection of classified information are 
vital to the accomplishment of the mission of the Department of 
Defense. Each DoD member whose duties involves access to classi- 
fied information must perform these functions in a manner ensuring 
the integrity of the information. Analysis of this matter within 
the Department of Defense reveals the need to increase supervisory 
attention to the trustworthiness of personnel for access to 
classified information and duties involving the handling and 
safeguarding of classified information. 


Accordingly, prior to October 1, 1985 take the necessary action to 
incorporate the following requirements in appropriate requlations: 


(1) Incorporate the following specific matters in regularly 
scheduled fitness and performance reports of military 
and civilian personnel whose duties entail access to 
classified information: 


(a) Whether the supervisor is aware of any action, 
behavior or condition that would constitute a 
reportable matter under the respective department/ 
agency's security regulations governing eligibility 
for access to classified information. If the response 
is affirmative, the supervisor should further indicate 
whether an appropriate report has been made. 


(b) Comments regarding an employee's discharge of security 
responsibilities. 


(2) Establish procedures to require a review by the immediate 
supervisor of the DD Form 398 (Statement of Personal History 
(SPH)) and related information submitted by employees 
in connection with a request for a periodic reinvestiga- 
tion. Immediate supervisors will review the Statement of 
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Personal History to determine if any relevant personnel 
security information (in terms of the criteria delineated 
in paragraph 2-200, DoD Regulation 5200.2R) of which the 
supervisor is aware has been excluded. If the supervisor 
is unaware of any such additional information pertaining 
to the individual, the supervisor will append a certi- 
fication to that effect on the SPH. However, If the 
supervisor is aware of such additional information, that 
fact will be reported in writing by the supervisor to the 
cognizant security adjudicative authority. This report 
should include any information provided by the subject 

by way of clarification or mitigation as well as any 
additional information known by the supervisor that is 
pertinent to the continued eligibility of the subject for 
access to classified information. 


Initially, this requirement may be met by ad hoc procedures and 
entries. However, they should be incorporated in appropriate 
regulations and forms at the earliest practicable opportunity. 


Provide for appropriate DoD components to report actions to 


implement these requirements to the Under Secretary of Defense 
for Policy by November 15, 1985. 


e 


MO ae i BE ee, 
ra A bier. Sf. Of 
William H. Taft, Ivé 
Deputy Secretary of Defense 
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THE SECRETARY OF DEFENSE 


WASHINGTON, THE DISTRICT OF COLUMBIA 


MEMORANDUM FOR SECRETARIES OF THE MILITARY DEPARTMENTS 
CHAIRMAN, JOINT CHIEFS OF STAFF 
UNDER SECRETARIES OF DEFENSE 
ASSISTANT SECRETARIES OF DEFENSE 
GENERAL COUNSEL 
INSPECTOR GENE RAL 
ASSISTANTS TO THE SECRETARY OF DEFENSE 
DIRECTORS OF THE DEFENSE AGENCIES 
DEPUTY ASSISTANT SECRETARY OF DEFENSE (ADMINISTRATION) 


SUBJECT: Commission to Review and Evaluate DoD Security Policies 
and Procedures 


This memorandum is a follow-on to my recent announcement of 
the establishment of a Commission to conduct a review and evaluation 
of Department of Defense security policies and procedures. The 
Commission will identify any systemic vulnerabilities or weaknesses 
in DoD security programs, including an analysis of lessons learned 
from incidents which have occurred recently, and make recommendations 
for change, as appropriate. The Terms of Reference for the Commission 
is attached. 


General Richard G. Stilwell, USA (Ret.) is hereby appointed to 
chair the Commission which shall be comprised of cognizant senior 
officials of the Office of the Secretarty of Defense, Military 
Departments, Defense Agencies, and a representative from defense 
industry. Addressees should lend full cooperation to this important 
effort and provide personnel and information, as requested, to 
support the Commission's analysis and facilitate the early completion 
of the review. 


A report of findings and recommendations will be submitted to 
me within 120 days of thi&® date. 


fr orig 
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Terms of Reference 
Commission To Review DoD Security Policies and Procedures 


The Commission will be responsibie for conducting a review 
and evaluation of Department of Defense security policies and 
procedures, identify weaknesses, and make recommendations for 
change, as appropriate. 


Membership 


General Richard C. Stilwell, USA (Ret) Chairman 

Lt. Gen. Arthur FE. Brown Dir, Army Staff 

R. Adm. John L. Butts Dir, Naval Intelligence 

Mr. Chapman B. Cox DoD General Counsel 

Mr. William O. Cregar Dir, Security, E. I. duPont 
deNemours & Co. 

Lt. Gen. Monroe W. Hatch Inspector General, USAF 

Mr. Robert W. Helm ASD(Comptroller) 

Dr. Fred C. Ikle USD(Policy) 

Dr. Lawrence J. Korb ASD(MI&L) 

Adm. Robert L. J. Long, USN (Ret) 

Lt. Gen. William E. Odom Dir, NSA 

Lt. Gen. Winston D. Powers Dir, DCA 

Lt. Gen. James A. Williams Dir, DIA 


Functions 
Examine existing DoD security policies and procedures. 


Review recent security incidents and reported deficiencies, 
with particular emphasis on potential vulnerabilities. 


Interview cognizant DoD officials and other individuals who 
are in a position to shed light on the areas under consideration. 


Examine DoD-wide security organizations and systems, to the 
extent required. 


Identify deficiencies in policies and systems and develop 
corrective actions which will accomplish the necessary 
improvements. 


Prepare a report of findings and recommendations for the 
Secretary of Defense. 


Reporting 


A report will be submitted to the Secretary of Defense not 
later than 120 days from the establishment of the Commission. 
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